The runner should execute gh actions-lock --verify automatically.