ollieb89/actions-lockfile-generator
Pin GitHub Action tags to full commit SHAs and generate auditable lockfiles to prevent supply chain attacks
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token for resolving action SHAs via the API | yes | ${{ github.token }} |
| workflow-dir | Directory containing workflow files to scan | no | .github/workflows |
| config-path | Path to actions-lockfile.config.yml | no | actions-lockfile.config.yml |
| mode | scan=report only | pin=write pinned files | enforce=fail if unpinned | no | scan |
| create-pr | Create a PR with pinned workflow files (requires write permissions) | no | false |
| output-file | Path for the generated lockfile | no | actions-lock.json |
Outputs
| name | description |
|---|---|
| unpinned-count | Number of unpinned action references found |
| pinned-count | Number of actions successfully pinned to SHA |
| lockfile-path | Path to the generated lockfile (empty in scan/dry-run mode) |