lockfile

A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact commit.

Handle locking via pid files

Lean, Bundler-compatible gem manager written in Go

Checksums for GitHub Actions.

The authoritative definition of the GitHub Actions dependency lockfile format, plus a Go parser for auditing and verifying the action pins in use across a repo's workflows.

A Go library for parsing package manager manifest and lockfiles.

Pin AI Skill behavior. Block unapproved drift in CI. See exactly what changed in every PR.

Framework to make service from your application(with different log types, http, suid, graceful restart)

A reproducible toolchain manager for blockchain development.

Explain any lockfile change: bumps release-verified against 22 registries, vulns (OSV), ages, deprecations, typosquats, integrity tampering — 61 formats incl. pdm.lock, vcpkg, mise.lock, build.gradle, pom.xml, go.sum, GitHub Actions, GitLab CI, Dockerfiles, Kubernetes, Helm, SBOMs. CLI + CI gate + MCP server + playground. By an AI agent.

Trust lockfile and verification for software dependencies.

Finds trust regressions in your dependency tree before they land: npm, PyPI, crates.io, JSR. Single binary, no telemetry.

Lockfile-based integrity verification for AI agent skills, prompts, hooks, and tools

Handle locking via pid files

Turn unreadable lockfile diffs into a human summary: which deps were added, removed, and upgraded (with major-bump warnings). npm, pnpm, yarn, Cargo, poetry.

Offline semantic dependency review across npm, pnpm, Yarn, uv, Poetry, Cargo, and Go.

GitHub CLI extension: gh lockvet — vet the PR you're standing in for dependency risk (vulns, malware shapes, typosquats, tampering) across 61 lockfile/manifest formats

Lock & verify Terraform/OpenTofu module sources by commit digest - the integrity providers get from the native lockfile, but modules don't.

Readproof — the lockfile and replay primitive for what AI agents read: stable identity, freshness policy, content-addressed snapshots, per-run manifests, diff, byte-exact replay, evidence bundles.

Package manager and lockfile for agent skills (SKILL.md/AGENT.md/.cursorrules). Resolve, pin, hash, bundle, sign. Single Go binary.