From 0a6c264307e28706fcac318535d29367dcfa9d3e Mon Sep 17 00:00:00 2001 From: mrtus Date: Tue, 3 Nov 2026 16:24:14 +0100 Subject: [PATCH] Lock the workflow action dependencies in actions.lock GitHub's workflow dependency lockfile pins every action a workflow uses, transitive ones included, to the commit its ref resolved to, so a tag repointed upstream can no longer run unreviewed code in our CI. It is generated by the gh actions-lock extension with --no-narrow and --no-migrate-local-actions, the flags Renovate regenerates it with, so actions/checkout@v5 and actions/setup-node@v5 stay as written. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/actions.lock | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..40ec2b5 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,19 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/ci.yml': + - 'actions/checkout@v5' + - 'actions/setup-node@v5' +dependencies: + 'actions/checkout@v5': + ref: 'v5' + commit: 'sha1-fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09' + owner_id: 44036562 + repo_id: 197814629 + 'actions/setup-node@v5': + ref: 'v5' + commit: 'sha1-a0853c24544627f65ddf259abe73b1d18a591444' + owner_id: 44036562 + repo_id: 189476904