ci: adopt GitHub Actions workflow lockfile (unblocks estate-wide startup_failure)

.github/actions/signed-push/action.yml

@@ -39,7 +39,7 @@ runs:
     # and auto-marks the resulting commits as "Verified". A PAT would leave them
     # Unverified — which is why this must be an App token, not GITHUB_TOKEN/PAT.
     - name: Push local commits as Verified
-      uses: Asana/push-signed-commits@6e073ae68b04d4322be613a6cabf391acb03ca44 # v1
+      uses: Asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897 # v1.3
       with:
         github-token: ${{ steps.app-token.outputs.token }}
         local_branch_name: ${{ steps.branch.outputs.name }}

.github/workflows/actions.lock

@@ -0,0 +1,207 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/affinescript-verify.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'ocaml/setup-ocaml@v3.7.0'
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.11.0'
+    '.github/workflows/changelog-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/codeql-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/deno-ci-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'denoland/setup-deno@v2.0.5'
+    '.github/workflows/doc-format.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/dyadt-verify.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/echidna-verify.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/elixir-ci-reusable.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'erlef/setup-beam@v1.24.1'
+    '.github/workflows/governance-reusable.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'denoland/setup-deno@v2.0.5'
+        - 'editorconfig-checker/action-editorconfig-checker@v2.2.0'
+        - 'erlef/setup-beam@v1.24.1'
+    '.github/workflows/hypatia-scan-reusable.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'erlef/setup-beam@v1.24.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/launcher-standard-lockstep.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/makefile-blocker.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/mirror-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+        - 'webfactory/ssh-agent@v0.10.0'
+    '.github/workflows/no-js-scan.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/readme-derive-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/registry-verify.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/rust-ci-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.1'
+    '.github/workflows/scorecard-enforcer.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'ossf/scorecard-action@v2.4.4'
+    '.github/workflows/scorecard-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'ossf/scorecard-action@v2.4.4'
+    '.github/workflows/secret-scanner-reusable.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/self-test.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/signed-push-smoke.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
+        - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897'
+    '.github/workflows/spark-theatre-gate.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1':
+        ref: 'v3.2.0'
+        commit: 'sha1-bcd2ba49218906704ab6c1aa796996da409d3eb1'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/deploy-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-python@v2':
+        ref: 'v2'
+        commit: 'sha1-e9aba2c848f5ebd159c070c61ea2c4e2b122355e'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897':
+        ref: 'v1.3'
+        commit: 'sha1-d615ca88d8e1a946734c24970d1e7a6c56f34897'
+        owner_id: 1472111
+        repo_id: 772313726
+        uses:
+            - 'actions/setup-python@v2'
+    'denoland/setup-deno@v2.0.5':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
+        owner_id: 1940490
+        repo_id: 260749683
+    'editorconfig-checker/action-editorconfig-checker@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
+        owner_id: 26415196
+        repo_id: 297874902
+    'erlef/setup-beam@v1.24.1':
+        ref: 'v1.24.1'
+        commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+        owner_id: 47606891
+        repo_id: 331103973
+    'github/codeql-action@v4.37.4':
+        ref: 'v4.37.4'
+        commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@v2.11.0':
+        ref: 'v2.11.0'
+        commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
+        owner_id: 75048950
+        repo_id: 623796603
+    'ocaml/setup-ocaml@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-15d660006c1d3110d77c34b7faa3bddefe8b82f0'
+        owner_id: 1841483
+        repo_id: 220799100
+    'ossf/scorecard-action@v2.4.4':
+        ref: 'v2.4.4'
+        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
+        owner_id: 67707773
+        repo_id: 421101922
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305
+    'swatinem/rust-cache@v2.9.1':
+        ref: 'v2.9.1'
+        commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4'
+        owner_id: 580492
+        repo_id: 298565987
+    'webfactory/ssh-agent@v0.10.0':
+        ref: 'v0.10.0'
+        commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
+        owner_id: 135788
+        repo_id: 208510314

.github/workflows/affinescript-verify.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: AffineScript Verify
 # Direct pushes only on integration branches. Feature-branch validation
@@ -52,7 +53,7 @@
       contents: read
     steps:
       - name: Checkout standards
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -89,7 +90,7 @@
         # advisory: compiler checkout is report-only until the port backlog
         # is cleared and BLOCKING flips to true.
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ env.COMPILER_REPO }}
           ref: ${{ env.COMPILER_REF }}
@@ -100,7 +101,7 @@
         # advisory: setup failures should surface as signal without blocking
         # unrelated standards changes while AffineScript verification matures.
         continue-on-error: true
-        uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3
+        uses: ocaml/setup-ocaml@v3.7.0
         with:
           ocaml-compiler: "5.1"
 

.github/workflows/boj-build.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 #
 # OPTIONAL: BoJ Server Build Trigger
@@ -36,7 +37,7 @@ jobs:
     # when unconfigured.
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
@@ -71,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: K9-SVC Validation
         run: |

.github/workflows/casket-pages.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
 
@@ -22,22 +23,22 @@
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
+        uses: haskell-actions/setup@v2.11.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -81,10 +82,10 @@
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
 
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v3
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
 
@@ -98,4 +99,4 @@
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@v5.0.0

.github/workflows/changelog-reusable.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 #
@@ -61,15 +62,15 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout caller repository (full history)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.ref }}
           fetch-depth: 0
           path: caller
 
       - name: Checkout standards (for canonical cliff.toml)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/standards
           ref: main

.github/workflows/changelog.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Changelog
 

.github/workflows/codeql-reusable.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
 #
@@ -87,15 +88,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: ${{ inputs.language }}
           build-mode: ${{ inputs.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:${{ inputs.language }}"

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 

.github/workflows/deno-ci-reusable.yml

@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # deno-ci-reusable.yml — Reusable Deno CI bundle (RSR).
 #
@@ -58,12 +59,12 @@
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.ref }}
 
-      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
+      - uses: denoland/setup-deno@v2.0.5
         with:
           deno-version: ${{ inputs.deno-version }}