@@ -584,3 +584,74 @@ jobs:
 	assert.Equal(t, 2, countGraphQL(ct), "resolve + parity: %v", ct.urls)
 	assert.Contains(t, readTempLockfilePins(t), "actions/checkout@v4.2.1")
 }
+
+// useDefaultTransport routes anonymous REST calls, which use
+// http.DefaultTransport, through rt for the rest of the test.
+func useDefaultTransport(t *testing.T, rt http.RoundTripper) {
+	t.Helper()
+	orig := http.DefaultTransport
+	http.DefaultTransport = rt
+	t.Cleanup(func() { http.DefaultTransport = orig })
+}
+
+// TestParity_DependabotProxyInconclusiveAborts: under the Dependabot proxy
+// a rate limit or server error on a recorded pin aborts with exit 2 so
+// Dependabot retries, instead of passing on a warning. Outside the proxy
+// the same failure stays a warning.
+func TestParity_DependabotProxyInconclusiveAborts(t *testing.T) {
+	for name, tc := range map[string]struct {
+		resp   httpmock.Responder
+		status string
+	}{
+		"rate-limited 403": {httpmock.StatusResponseWithHeaders(http.StatusForbidden, map[string]string{"X-RateLimit-Remaining": "0"}), "HTTP 403"},
+		"503":              {httpmock.StatusResponse(http.StatusServiceUnavailable), "HTTP 503"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for _, args := range [][]string{nil, {"--verify"}} {
+				t.Setenv("GH_ACTIONS_LOCK_DEPENDABOT_PROXY", "1")
+				reg := &httpmock.Registry{}
+				reg.Register(httpmock.REST("GET", `^/repos/actions/checkout$`), tc.resp)
+				useDefaultTransport(t, reg)
+				path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.1
+`, "actions/checkout@v4.2.1=sha1-"+parityTestSHA)
+				lockBefore := readTempLockfilePins(t)
+				wfBefore, err := os.ReadFile(path)
+				require.NoError(t, err)
+
+				_, stderr, err := runCommandWithHTTP(t, reg, append(args, path)...)
+				require.Error(t, err, stderr)
+				assert.NotErrorIs(t, err, errSilent, "a tool failure exits 2")
+				assert.Contains(t, err.Error(), tc.status)
+				assert.Contains(t, err.Error(), "actions/checkout")
+				assert.Equal(t, lockBefore, readTempLockfilePins(t))
+				wfAfter, err := os.ReadFile(path)
+				require.NoError(t, err)
+				assert.Equal(t, string(wfBefore), string(wfAfter))
+			}
+		})
+	}
+}
+
+func TestParity_InconclusiveWarnsWithoutProxy(t *testing.T) {
+	reg := &httpmock.Registry{}
+	path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.1
+`, "actions/checkout@v4.2.1=sha1-"+parityTestSHA)
+
+	_, stderr, err := runCommandWithHTTP(t, parityDown{reg}, "--verify", path)
+	require.NoError(t, err, stderr)
+	assert.Contains(t, stderr, "could not verify locked actions/checkout")
+}
@@ -109,6 +109,13 @@ func New(hostname string, opts ...ClientOption) (*Client, error) {
 	return &Client{Hostname: hostname, local: local, public: public, pinned: map[Repo]string{}}, nil
 }
 
+// DependabotProxy reports whether the CLI runs inside Dependabot, behind its
+// REST-only proxy. Dependabot retries on exit 2 and reads back only
+// actions.lock.
+func DependabotProxy() bool {
+	return os.Getenv("GH_ACTIONS_LOCK_DEPENDABOT_PROXY") == "1"
+}
+
 func newClient(hostname string, opts ...ClientOption) (*Client, error) {
 	var cfg clientConfig
 	for _, o := range opts {
@@ -117,7 +124,7 @@ func newClient(hostname string, opts ...ClientOption) (*Client, error) {
 
 	c := &Client{
 		Hostname: hostname,
-		restOnly: os.Getenv("GH_ACTIONS_LOCK_DEPENDABOT_PROXY") == "1",
+		restOnly: DependabotProxy(),
 	}
 
 	apiOpts := api.ClientOptions{Host: hostname}
 
@@ -29,10 +29,13 @@ import (
 // transfer redirect to the same repo ID is a warning, also inside a
 // remote composite; a different ID or a name that doesn't resolve blocks. Fresh pins fail closed: an
 // inconclusive check keeps them out of the write.
-func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.ParsedWorkflow, store *lockfile.State, report *checks.Report, recordedKeys map[string]bool, resolved []dep.Dependency, parents map[string][]string, keep func(checks.Category) bool) {
+//
+// Under the Dependabot proxy any inconclusive check is an error: the run
+// aborts so Dependabot retries rather than shipping an unverified lock.
+func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.ParsedWorkflow, store *lockfile.State, report *checks.Report, recordedKeys map[string]bool, resolved []dep.Dependency, parents map[string][]string, keep func(checks.Category) bool) error {
 	gh := r.GHClient()
 	if gh == nil || store == nil {
-		return
+		return nil
 	}
 	reportIdx := make(map[string]int, len(report.Workflows))
 	for i, wr := range report.Workflows {
@@ -97,12 +100,19 @@ func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.Parse
 		}
 	}
 	if len(pins) == 0 {
-		return
+		return nil
 	}
 
 	states := gh.CheckPins(ctx, pins)
 	if ctx.Err() != nil {
-		return
+		return ctx.Err()
+	}
+	if ghapi.DependabotProxy() {
+		for i, st := range states {
+			if st.Err != nil {
+				return fmt.Errorf("could not verify locked %s/%s@%s: %w", pins[i].Owner, pins[i].Repo, parserlock.ShortSHA(pins[i].SHA), st.Err)
+			}
+		}
 	}
 	for i, st := range states {
 		for _, o := range owners[i] {
@@ -125,6 +135,7 @@ func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.Parse
 			wr.Findings = append(wr.Findings, f)
 		}
 	}
+	return nil
 }
 
 type parityOwner struct {
 
@@ -126,10 +126,10 @@ func Run(ctx context.Context, opts RunOptions) (*RunResult, error) {
 			}
 		}
 		endParity := prof.Phase("  parity check")
-		checkParity(ctx, r, parsed, opts.Store, report, recordedKeys, resolved, parents, keep)
+		err := checkParity(ctx, r, parsed, opts.Store, report, recordedKeys, resolved, parents, keep)
 		endParity()
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
+		if err != nil {
+			return nil, err
 		}
 	}
Original file line number	Diff line number	Diff line change
`@@ -29,10 +29,13 @@ import (`
`29`	`29`	`// transfer redirect to the same repo ID is a warning, also inside a`
`30`	`30`	`// remote composite; a different ID or a name that doesn't resolve blocks. Fresh pins fail closed: an`
`31`	`31`	`// inconclusive check keeps them out of the write.`
`32`		`-func checkParity(ctx context.Context, r resolve.Resolver, parsed []checks.ParsedWorkflow, store lockfile.State, report *checks.Report, recordedKeys map[string]bool, resolved []dep.Dependency, parents map[string][]string, keep func(checks.Category) bool) {`
	`32`	`+//`
	`33`	`+// Under the Dependabot proxy any inconclusive check is an error: the run`
	`34`	`+// aborts so Dependabot retries rather than shipping an unverified lock.`
	`35`	`+func checkParity(ctx context.Context, r resolve.Resolver, parsed []checks.ParsedWorkflow, store lockfile.State, report *checks.Report, recordedKeys map[string]bool, resolved []dep.Dependency, parents map[string][]string, keep func(checks.Category) bool) error {`
`33`	`36`	`gh := r.GHClient()`
`34`	`37`	`if gh == nil \|\| store == nil {`
`35`		`- return`
	`38`	`+ return nil`
`36`	`39`	`}`
`37`	`40`	`reportIdx := make(map[string]int, len(report.Workflows))`
`38`	`41`	`for i, wr := range report.Workflows {`
`@@ -97,12 +100,19 @@ func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.Parse`
`97`	`100`	`}`
`98`	`101`	`}`
`99`	`102`	`if len(pins) == 0 {`
`100`		`- return`
	`103`	`+ return nil`
`101`	`104`	`}`
`102`	`105`
`103`	`106`	`states := gh.CheckPins(ctx, pins)`
`104`	`107`	`if ctx.Err() != nil {`
`105`		`- return`
	`108`	`+ return ctx.Err()`
	`109`	`+ }`
	`110`	`+ if ghapi.DependabotProxy() {`
	`111`	`+ for i, st := range states {`
	`112`	`+ if st.Err != nil {`
	`113`	`+ return fmt.Errorf("could not verify locked %s/%s@%s: %w", pins[i].Owner, pins[i].Repo, parserlock.ShortSHA(pins[i].SHA), st.Err)`
	`114`	`+ }`
	`115`	`+ }`
`106`	`116`	`}`
`107`	`117`	`for i, st := range states {`
`108`	`118`	`for _, o := range owners[i] {`
`@@ -125,6 +135,7 @@ func checkParity(ctx context.Context, r *resolve.Resolver, parsed []checks.Parse`
`125`	`135`	`wr.Findings = append(wr.Findings, f)`
`126`	`136`	`}`
`127`	`137`	`}`
	`138`	`+ return nil`
`128`	`139`	`}`
`129`	`140`
`130`	`141`	`type parityOwner struct {`
Original file line number	Diff line number	Diff line change
`@@ -126,10 +126,10 @@ func Run(ctx context.Context, opts RunOptions) (*RunResult, error) {`
`126`	`126`	`}`
`127`	`127`	`}`
`128`	`128`	`endParity := prof.Phase(" parity check")`
`129`		`- checkParity(ctx, r, parsed, opts.Store, report, recordedKeys, resolved, parents, keep)`
	`129`	`+ err := checkParity(ctx, r, parsed, opts.Store, report, recordedKeys, resolved, parents, keep)`
`130`	`130`	`endParity()`
`131`		`- if ctx.Err() != nil {`
`132`		`- return nil, ctx.Err()`
	`131`	`+ if err != nil {`
	`132`	`+ return nil, err`
`133`	`133`	`}`
`134`	`134`	`}`
`135`	`135`