Feature request: allow selected action owners to be explicitly excluded from lockfile pinning

オープン
  • 何か問題がありますか？
#194 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
45/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
github-actions, go
領域
cli, security

調査の方向性

Start by tracing how gh actions-lock resolves workflow refs, reports findings such as self-repository-action, and verifies lockfile entries; then inspect runtime enforcement and lockfile parsing. The issue names no source files or tests, so locate those entry points first. Done means exclusions are recorded with reasons in the lockfile, reported during resolution, and treated as compliant by verification and enforcement only when listed.

索引モデルが issue の本文から書いたものです。

説明

feature-request

Problem

Our workflows mix public GitHub-maintained actions with internal actions published by our own organization, e.g.:

steps:
  - uses: actions/checkout@v7
  - uses: internal-action/build-image@v1

We want SHA-locked integrity for third-party/public actions (actions/*), but our internal actions are deliberately consumed via a floating major tag (@v1). They are released frequently under our own access controls and review process, and we want consumers to pick up patch releases without a lockfile change for every internal release.

Today gh actions-lock has no way to exclude specific actions or owners. Because enforcement requires every dependency of an onboarded workflow to be present in actions.lock, our only options are:

  1. Lock internal actions too and run --relock constantly (heavy churn for every internal release), or
  2. Leave the whole workflow un-onboarded, losing protection for the public actions as well.

Neither is a good fit. Option 2 in particular pushes teams to skip locking entirely.

Proposal

Support an explicit, auditable exclusion recorded in the lockfile itself (not only as a CLI flag), so the runtime can tell "intentionally unlocked" apart from "missing":

# .github/workflows/actions.lock
unlocked:
  - owner: internal-action        # or a pattern like 'my-org/*'
    reason: 'Internal actions, governed by org release process'

Suggested behavior:

  • gh actions-lock skips resolution for matching refs and reports them as an informational finding (similar to self-repository-action), never silently.
  • --verify / --verify-local treat matching refs as compliant only if they are listed under unlocked.
  • Runtime enforcement accepts listed refs unpinned and still requires everything else to be locked.
  • Optionally, restrict eligible owners (e.g. same owner/org as the repository, or an org-level policy) so this can't be used to unlock arbitrary third-party actions.
主要言語
Go
スター
295
フォーク
21
平均マージ
1日 3時間
マージ済み PR（30日）
64

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

github/gh-actions-lock のほかの issue

github/gh-actions-lock の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。