See: zizmorcore/zizmor#2371 (comment)
See: pypa/gh-action-pypi-publish#425
On particular case that I have is that I can generate an action.lock file but there's no way to lock the pypa/gh-action-pypi-publish action because of pypa/gh-action-pypi-publish#425 (unless you want to pin to a slower 2+ year old version). If there is lockfile support at some future time, it would be good to check all un-pinned actions to ensure they are in the lockfile, and with ‑‑fix to regenerate the lockfile if they are not.
@dupuy
See: zizmorcore/zizmor#2371 (comment)
See: pypa/gh-action-pypi-publish#425
On particular case that I have is that I can generate an action.lock file but there's no way to lock the pypa/gh-action-pypi-publish action because of pypa/gh-action-pypi-publish#425 (unless you want to pin to a slower 2+ year old version). If there is lockfile support at some future time, it would be good to check all un-pinned actions to ensure they are in the lockfile, and with ‑‑fix to regenerate the lockfile if they are not.
@dupuy