[renovate]

This PR contains the following updates:

Package	Update	Change
github/gh-actions-lock	patch	v0.4.0 → v0.4.1

---

Release Notes

github/gh-actions-lock

v0.4.1: gh-actions-lock 0.4.1

Compare Source

What's Changed

• Update README to remove public preview warning by @​Steve-Glass in #​248
• Keep nested pins whose owner/repo case differs from the lockfile by @​nodeselector in #​260

Full Changelog: github/gh-actions-lock@v0.4.0...v0.4.1

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 76a202e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🤖 Claude Dependency Review

✅ Recommended Actions

None — safe to merge as-is. This patch update contains a bug fix and documentation improvements with no breaking changes.

📦 Update Summary

• Library: github/gh-actions-lock
• Version: v0.4.0 → v0.4.1
• Change Type: Patch

📝 Release Notes

Source: https://github.com/github/gh-actions-lock/releases/tag/v0.4.1

Changes in v0.4.1

Documentation:

• Removed the public preview warning from the README (#248)

Bug Fixes:

• Fixed an issue where nested pins whose owner/repo case differs from the lockfile were wrongly removed as orphans (#260, fixes #257)
  • The lockfile stores owner/repo names in lowercase, but when a composite action uses mixed-case references, the tool now correctly returns the case-sensitive spelling used by the action rather than the lowercased lockfile entry
  • This prevents the tool from breaking the link to parent entries and incorrectly removing valid nested pins

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found. No CVEs or security advisories exist for gh-actions-lock v0.4.0 or v0.4.1
• Supply-chain notes: None. This is a GitHub CLI extension maintained by GitHub for pinning GitHub Actions to commit SHAs. No suspicious lifecycle scripts, maintainer changes, or unexpected dependencies detected.

🚨 Breaking Changes

None.

✨ Main Changes

Bug Fixes

• Nested pin case handling: Composite actions that reference other actions with mixed-case owner/repo names (e.g., actions/Checkout vs actions/checkout) now work correctly. Previously, the tool would remove these as orphans because the lockfile stores names in lowercase.

Documentation

• README update: Removed the public preview warning, indicating the tool is now considered stable for general use.

🔍 Impact Analysis

📁 Usage Locations

github/gh-actions-lock is used in the following 5 files:

1. renovate.json

   "constraints": {
     "ghActionsLock": "v0.4.1"
   }

   • Feature used: Version constraint for Renovate to manage gh-actions-lock updates
   • Impact: This PR updates this constraint. No breaking changes.

2. package.json

   "actions:lock:install": "gh extension install github/gh-actions-lock --pin \"$(node -p \"require('./renovate.json').constraints.ghActionsLock\")\" --force",
   "actions:lock:update": "pnpm run actions:lock:install && gh actions-lock --no-narrow",
   "actions:lock:check": "pnpm run actions:lock:install && gh actions-lock --verify"

   • Feature used: CLI scripts to install, update, and verify the GitHub Actions lockfile
   • Impact: The bug fix improves reliability when using composite actions with mixed-case references. No code changes required.

3. .github/workflows/actions.lock

   # This file is machine-generated by `gh actions-lock`.
   # Do not edit by hand; run `gh actions-lock` to update.
   # Docs: https://gh.io/actions-lockfile
   version: 'v0.0.3'

   • Feature used: Lockfile generated and managed by gh-actions-lock
   • Impact: The bug fix ensures nested pins with different case are preserved correctly in this file. No manual changes needed.

4. .github/workflows/ci.yml

   run: |
     pnpm actions:lock:check || {
       echo "::error file=.github/workflows/actions.lock::actions.lock check failed. If it is out of date, run 'pnpm actions:lock:update' and commit the result."
       exit 1
     }

   • Feature used: CI verification that the actions lockfile is up to date
   • Impact: The update improves the verification logic. No workflow changes required.

5. AGENTS.md

   - `pnpm actions:lock:update` - Regenerate `.github/workflows/actions.lock` after changing `uses:` in `.github/workflows/` or `.github/actions/`. Plain `gh actions-lock`, which the lockfile header suggests, rewrites the SHA pins that ghalint and zizmor require to tags
   - `pnpm actions:lock:check` - Verify `.github/workflows/actions.lock` is up to date

   • Feature used: Documentation of the actions:lock commands
   • Impact: No changes needed to documentation.

🎯 Impact Summary

Scope: Development tooling only. This tool is used to pin GitHub Actions to specific commit SHAs for security and reproducibility.

Risk: None. The bug fix improves handling of nested composite actions, which benefits this repository if any of the workflows in .github/workflows/ use composite actions with mixed-case repository references.

Required Actions: None. Simply merging this PR will update the constraint in renovate.json, and the next time pnpm actions:lock:install runs (either manually or in CI), it will install v0.4.1.

---