undefined

points

[-]

say more about how you would envision the runner handling this? An allowlist of actions?

[-]

The runner should execute gh actions-lock --verify automatically.