Action-locker: pin, verify, and vendor GHAs

Join the discussion

• Hacker News
• OP here.

  I know there are a few solutions out there to the "GHA doesn't have a lockfile" problem that we all know and love.

  This is the one that I created to use internally at Old Well Labs. It makes using the `Require actions to be pinned to a full-length commit SHA` setting way less painful for us. Unlike most other options, it also supports vendoring actions within the repo (that's why it's called action-locker, like a locker). So if an upstream repo totally leaves github, you won't be high and dry.

  It's open source, has extremely limited dependencies, lets you age-gate ghas (ex: don't deploy ones that are newer than x days old) and works with pre-commit hooks ( there's a demo repo showing this - steph-owl/action-locker-demo )

  by sudosteph