Repository navigation
Bug: Modifying owner_id in a lockfile does not cause a validation failure #211
Description
I noticed this while trying random things out with a lockfile: if owner_id is perturbed, it doesn't cause a validation failure (despite no longer being the correct owner identifier for the action reference).
(I think my expected behavior here is a hard failure, since the lockfile is invalid.)
MRE here: woodruffw-experiments/actions-lockfile-experiments#2
Reacted by Steve-Glass
Activity
nodeselector commentedon Oct 21, 2026
An owner_id change is expected during repo transfers but I think we can be stricter here. Thanks for the MRE!
[-]Modifying `owner_id` in a lockfile does not cause a validation failure[/-]woodruffw commentedon Oct 22, 2026
Thanks! Yeah, it makes sense to have some kind of rename malleability, but as an end user my expectation is that a lockfile fails until I approve/validate the rename 🙂