github_actions: gate lockfile updates behind experiment

Author: nodeselector

github_actions/lib/dependabot/github_actions/file_fetcher.rb

@@ -5,6 +5,7 @@
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
+require "dependabot/experiments"
 require "dependabot/github_actions/constants"
 
 module Dependabot
@@ -79,6 +80,7 @@ def fetch_files
       # repository workflows. Composite-action directories cannot own a lockfile.
       sig { returns(T.nilable(DependencyFile)) }
       def actions_lockfile
+        return unless Dependabot::Experiments.enabled?(:github_actions_lockfile)
         return unless source.hostname == GITHUB_COM
         return fetch_file_if_present(LOCKFILE_PATH) if directory == "/"
 

github_actions/spec/dependabot/github_actions/file_fetcher_spec.rb

@@ -91,6 +91,7 @@
 
       context "when an actions.lock is present" do
         before do
+          Dependabot::Experiments.register(:github_actions_lockfile, true)
           stub_request(:get, url + ".github/workflows?ref=sha")
             .with(headers: { "Authorization" => "token token" })
             .to_return(
@@ -117,6 +118,7 @@
 
     context "when an actions.lock is present" do
       before do
+        Dependabot::Experiments.register(:github_actions_lockfile, true)
         # Re-stub the workflows listing to include the lockfile alongside the
         # workflow files, then stub the lockfile content fetch.
         stub_request(:get, url + ".github/workflows?ref=sha")
@@ -146,6 +148,19 @@
           )
       end
 
+      context "when the experiment is disabled" do
+        before { Dependabot::Experiments.reset! }
+
+        it "keeps the existing workflow-only behavior" do
+          expect(file_fetcher_instance.files.map(&:name))
+            .to match_array(
+              %w(.github/workflows/sherlock-workflow.yaml
+                 .github/workflows/integration-workflow.yml)
+            )
+          expect(a_request(:get, url + ".github/workflows/actions.lock?ref=sha")).not_to have_been_made
+        end
+      end
+
       context "with a non-github.com source" do
         let(:credentials) do
           [{
@@ -210,6 +225,7 @@
 
       context "when an actions.lock is present" do
         before do
+          Dependabot::Experiments.register(:github_actions_lockfile, true)
           stub_request(:get, url + ".github/workflows?ref=sha")
             .with(headers: { "Authorization" => "token token" })
             .to_return(