From 80f68da4a2a17150ab83471014c22291b8e2bf1b Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Thu, 22 Oct 2026 09:16:02 -0700 Subject: [PATCH 1/2] README: clarify --verify-local is coverage only Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3117005e..7a34b856 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,7 @@ Run `gh auth login --hostname TENANT.ghe.com`, then run `gh actions-lock` from t | `gh actions-lock` | yes | yes | Onboarding and fixing the lockfile | | `gh actions-lock --relock` | yes | yes | Advancing moved refs (`main`, `v4`) to current upstream commits | | `gh actions-lock --verify` | no | yes | CI: the same checks as a fix run | -| `gh actions-lock --verify-local` | no | no | Pre-commit: every `uses:` has a lockfile entry | +| `gh actions-lock --verify-local` | no | no | Pre-commit: every `uses:` has a lockfile entry (coverage only, not trust) | | `gh actions-lock --no-fix` | no | yes | Read-only report | Other flags: @@ -60,6 +60,7 @@ Other flags: - Reusable workflows called at `jobs..uses` from another repository are not locked ([#179](https://github.com/github/gh-actions-lock/issues/179)). - Local `./…` actions are never followed or locked, so one that uses remote actions is a blocking error until you pass `--migrate-local-actions` (rewrites same-repo `./…` to `$/…`) or `--ignore-local-actions`. - Container images are not locked, and any image without an `@sha256:` digest, including one chosen by a `${{ }}` expression, is a warning ([#236](https://github.com/github/gh-actions-lock/issues/236)). +- `--verify-local` only checks coverage, not that entries are trustworthy, so forged entries (fork-only or impostor commits, retargeted tags) pass it. Use `--verify` in CI. - A lockfile change that moves a floating ref (`v4`, `main`) back to an older commit in its history isn't detected, so review lockfile diffs or pin exact tags. ## Learn more From b9d8a4d58ce8b83614a5fa0669952d46b29c747a Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Thu, 22 Oct 2026 09:18:09 -0700 Subject: [PATCH 2/2] README: describe --verify-local provenance limit without alarm Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7a34b856..66b0afc7 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,7 @@ Run `gh auth login --hostname TENANT.ghe.com`, then run `gh actions-lock` from t | `gh actions-lock` | yes | yes | Onboarding and fixing the lockfile | | `gh actions-lock --relock` | yes | yes | Advancing moved refs (`main`, `v4`) to current upstream commits | | `gh actions-lock --verify` | no | yes | CI: the same checks as a fix run | -| `gh actions-lock --verify-local` | no | no | Pre-commit: every `uses:` has a lockfile entry (coverage only, not trust) | +| `gh actions-lock --verify-local` | no | no | Pre-commit: every `uses:` has a lockfile entry (coverage only, not provenance) | | `gh actions-lock --no-fix` | no | yes | Read-only report | Other flags: @@ -60,7 +60,7 @@ Other flags: - Reusable workflows called at `jobs..uses` from another repository are not locked ([#179](https://github.com/github/gh-actions-lock/issues/179)). - Local `./…` actions are never followed or locked, so one that uses remote actions is a blocking error until you pass `--migrate-local-actions` (rewrites same-repo `./…` to `$/…`) or `--ignore-local-actions`. - Container images are not locked, and any image without an `@sha256:` digest, including one chosen by a `${{ }}` expression, is a warning ([#236](https://github.com/github/gh-actions-lock/issues/236)). -- `--verify-local` only checks coverage, not that entries are trustworthy, so forged entries (fork-only or impostor commits, retargeted tags) pass it. Use `--verify` in CI. +- `--verify-local` is an offline coverage check that doesn't verify provenance; `--verify` checks provenance before merge, and the runner checks it again at job start. - A lockfile change that moves a floating ref (`v4`, `main`) back to an older commit in its history isn't detected, so review lockfile diffs or pin exact tags. ## Learn more