Josh Gross

@Quintisimo this is a bit outside the scope of the `actions/github-script` action, but I'll try my best to help out. Can you double check that `PRIVATE_REGISTRY_TOKEN` is set to the...

> Why not just publish the package to npm? This action is not intended to be used as a package, so I do not want to publish it to `npm`.

@alambike or @patricioperezv could you clarify your use case? Are there examples we can add to the README for this? I'm fine with adding this if we have some solid...

Thanks for your contribution @peterbourgon! I'll need to do a bit of research and I'll get back to you on this change.

While I understand that `go.sum` is not a lockfile, it does contain module checksums that could prevent tampering. From that perspective, it provides a more complete picture of the dependencies...