Try github/gh-actions-lock: audit CI dependencies

Tested status: Documentation reviewed; commands and Actions not run.

Purpose, prerequisites and cost

Use the MIT-licensed github/gh-actions-lock extension to pin GitHub Actions dependencies in a disposable personal repository. Requires GitHub CLI, Git and a personal GitHub account with a test repository containing a workflow. This is a technical preview; enforcement availability varies by plan/rollout. No model API, Gemini, purchase or upgrade required. Avoid Actions runs if your included minutes are insufficient.

Commands

Run only from a disposable repository:

gh auth status
gh extension install github/gh-actions-lock
gh actions-lock
git status --short
git diff -- .github/workflows
gh actions-lock --verify

Inspect .github/workflows/actions.lock: compare each dependency's repository, reference and resolved commit. Do not commit changes until reviewed.

Expected output

A lockfile listing the workflow dependencies and exact commit pins; verification succeeds when the lockfile matches the workflow. Exact messages vary by preview version.

Troubleshooting

• Missing gh: install GitHub CLI.
• Authentication error: gh auth login using a personal account.
• Extension installation fails: check extension availability and network access.
• Verification fails: inspect stale/missing pins; review upstream changes before gh actions-lock --relock.
• Local-path actions may not be eligible for onboarding. Consult current project limitations.
• No runtime lockfile enforcement: report CLI inspection only, not guaranteed runtime pinning.

Score (0–5)

One point each: extension installs; lockfile created; external dependencies represented; verification passes; reviewer checks upstream commits. Record failures and exact output.

Evidence: Documentation reviewed yes; CLI run no; lockfile generated no; Actions/model experiment no; runtime enforcement verified no.

Sources: GitHub announcement, project README, MIT license.