[coconux3]

Checklist

• A link to a related issue in our repository
• A description of the changes proposed in the pull request.
• @mentions of the person or team responsible for reviewing proposed changes.

No related issue: this is a CI-only change.

Adds GitHub's workflow dependency lockfile. actions.lock records the commit behind every action the workflows use, so a moved tag can't change what runs. That includes chromium-headful-image.yaml and chromium-headless-image.yaml, where docker/login-action@v3 receives DOCKERHUB_TOKEN and docker/build-push-action@v6 pushes the onkernel/chromium-* images, and server-test.yaml, where browser-actions/setup-chrome@v2 runs in the job that holds DOCKERHUB_TOKEN.

• Added .github/workflows/actions.lock, generated with gh actions-lock and checked with gh actions-lock --verify (all 8 workflows valid).
• Action refs narrowed to exact releases, for example actions/checkout@v4.4.0 and docker/login-action@v3.7.0. oven-sh/setup-bun was already pinned by SHA: it is now written as v2.2.0, the same commit, recorded in the lockfile. Only uses: lines change.
• One thing stays outside the lockfile: the reusable workflows called from kernel/security-workflows/...@main (breakglass.yml, semgrep.yml, vuln-remediation.yml). Job-level reusable workflow calls are not covered by a lockfile.

Found by Plumber's analysis, reviewed and submitted by me.

---

Note

Low Risk
CI-only supply-chain hardening; no application runtime changes, only pinned GitHub Action versions and a generated lockfile.

Overview
Adds GitHub’s workflow dependency lockfile (.github/workflows/actions.lock) and pins every in-repo workflow step to exact action release refs so CI runs fixed commits even if tags move.

Across chromium-headful-image.yaml, chromium-headless-image.yaml, chromium-launcher-test.yaml, live-view-test.yaml, and server-test.yaml, floating tags like actions/checkout@v4 and docker/login-action@v3 become patch versions (e.g. v4.4.0, v3.7.0). oven-sh/setup-bun switches from a SHA pin to v2.2.0, with that commit recorded in the lockfile.

Reusable workflows (breakglass.yml, semgrep.yml, vuln-remediation.yml) stay listed in the lockfile with no pinned actions because they delegate to external workflows.

^{Reviewed by Cursor Bugbot for commit 9ff7188. Bugbot is set up for automated code reviews on this repo. Configure here.}