Workflow must use a lockfile. Run `gh actions pin <workflow-path>` to generate one. The following workflows are missing a lockfile: - dynamic/github-code-scanning/codeql