curlewlabs-com/Local Mutex

Serialize shared resources across self-hosted runners on the same machine. Kernel-level lockf/flock.

Trust Signals

name	description	required	default
name	Lock identifier. Echoed verbatim into the diagnostic ::notice:: annotations and hashed with SHA-256 to form the lock file basename under /tmp (as 'local-mutex-<64-hex-digest>.lock'). Pick a name that describes the resource being protected (e.g. 'tool-update', 'dep-cache-rebuild', 'db-migrate'). Any length and byte sequence is accepted; empty, whitespace-only, and control-character-containing (newline, tab, etc.) values are rejected.	yes	—
run	Shell command to execute while holding the lock. Runs under /bin/sh. Multi-line scripts are supported. Use `set -e` if you want abort-on- first-failure semantics — the wrapper does not impose them. Empty or whitespace-only values are rejected.	yes	—
lock-dir	Absolute path to the directory where the lock file is created. Defaults to /tmp. Override this only when /tmp is not shared across the runners on the same machine — for example, on containerized self-hosted runners where /tmp is container-local. The directory must exist and be writable by the runner user. The lock file basename inside this directory is the SHA-256 of name (as 'local-mutex-<64-hex-digest>.lock'), so callers setting the same name from two runners continue to serialize as long as they share lock-dir.	no	""

name	description
output-file	Path to a file containing all GITHUB_OUTPUT writes made by the inner command. Callers that need to propagate outputs across the composite action boundary can cat this file into their own GITHUB_OUTPUT in a subsequent step. See README.md for the pattern.