Why

Hosted Dependabot supplies a dummy GitHub token, while its proxy injects the real token only for GET and HEAD requests. gh-actions-lock used GraphQL POST requests during relock, so action resolution failed with 401 Bad credentials.

How

• Use the private integration context GH_ACTIONS_LOCK_DEPENDABOT_PROXY=1 to select REST-only mode at client startup. This avoids coupling behavior to the dummy token value without adding a CLI flag or documented user-facing feature.
• Resolve action files, peel annotated tags, and check branch reachability with REST GET requests without first attempting GraphQL.
• Reuse the existing REST fallback for public and proxy-authenticated private repositories.
• Preserve GraphQL batching and authentication-failure fallback for normal execution.

The fallback remains fail-closed: inaccessible repositories and unreachable refs still return errors. This does not require allowing authenticated POST requests through the Dependabot proxy.

Testing

• go test -race -count=1 ./...
• go vet ./...
• make fmt-check
• make build && /opt/homebrew/opt/ruby/bin/ruby test/integration/run.rb dependabot_proxy_rest_only

The integration scenario runs the compiled binary against a private-repository stub with REST responses only. Any GraphQL POST has no matching handler and fails the scenario.

A new gh-actions-lock release is required, and the Dependabot caller must set the private execution-context variable.