Allow placing actions.lock in .github folder (not in workflows) #262

Background & Motivation

When pushing changes to .github/workflows, I want to automatically update and commit (create PR) actions.lock within CI using GITHUB_TOKEN. To make this possible, actions.lock needs to be supported in an alternative path outside of .github/workflows, as GITHUB_TOKEN is not allowed to write content in workflows folder.

Because standard lockfile updates (without --relock) are purely additive operations, I believe that allowing automated lockfile updates upon push (create PR) does not cause unintended modifications or regression hazards.

Proposed Changes

• Support .github/actions.lock: Allow actions.lock to reside directly in the .github/ directory as an alternative path.
• Resolution Priority: Continue support for .github/workflows/actions.lock. This allows user can specify the hash for the action that won't be changed by CI workflow.