wtf is action-locker?

action-locker is a security tool for GitHub Actions, the automation scripts that run when you push code to GitHub. Normally a workflow references an action by a version tag like v4, but that tag can be moved to point at different code later, sometimes maliciously. action-locker locks each action to the exact commit it points to right now, so your automation cannot be silently swapped out from under you. The tool works in a few steps. Lock scans your workflow files, resolves every action reference to its exact commit, and writes a lockfile recording that commit along with when it was locked and where it is used. Rewrite then updates your workflow files to use those exact commit values while keeping the readable version tag as a comment. Vendor goes a step further and downloads a full copy of each locked action into your own repository, so even if the original action's repository disappears, you still have a working copy. Verify is the check that runs in your CI: it confirms every action is pinned to a real commit, that commit matches the lockfile, and any vendored copies still match what was originally downloaded. There is also an update command that checks whether newer versions of your locked actions are available, and flags cases where an action's source repository has vanished entirely. To reduce risk from very recent, possibly compromised commits, action-locker by default will not lock to a third party commit less than five days old, instead choosing the newest release that is old enough to have been reviewed by the wider community. The entire tool is a single Python file with no external dependencies, so it is easy to read and audit before you trust it with your CI pipeline.