chore(ci): adopt GitHub Actions dependency lockfile

.github/renovate.json

@@ -6,13 +6,22 @@
     "schedule:weekly",
     ":semanticCommitTypeAll(chore)"
   ],
-  "addLabels":["area: dependencies"],
+  "addLabels": ["area: dependencies"],
   "osvVulnerabilityAlerts": true,
   "postUpdateOptions": ["gomodTidy"],
   "constraints": {
     "go": "1.26.4"
   },
   "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"],
+      "matchStrings": [
+        "gh extension install github/gh-actions-lock --pin (?<currentValue>v[\\d.]+)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "github/gh-actions-lock"
+    },
     {
       "customType": "regex",
       "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"],

.github/workflows/actions.lock

@@ -0,0 +1,104 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/github-script@v9.0.0'
+        - 'actions/setup-go@v7.0.0'
+        - 'actions/setup-node@v7.1.0'
+        - 'actions/setup-python@v7.0.0'
+        - 'go-task/setup-task@v2.2.0'
+        - 'golang/govulncheck-action@v1.1.0'
+        - 'golangci/golangci-lint-action@v9.3.0'
+        - 'hustcer/setup-nu@v3.28'
+        - 'pnpm/action-setup@v6.0.10'
+    '.github/workflows/issue-awaiting-response.yml':
+        - 'actions/github-script@v9.0.0'
+    '.github/workflows/issue-closed.yml':
+        - 'actions/github-script@v9.0.0'
+    '.github/workflows/issue-experiment.yml':
+        - 'actions/github-script@v9.0.0'
+    '.github/workflows/issue-needs-triage.yml':
+        - 'actions/github-script@v9.0.0'
+    '.github/workflows/release-nightly.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+        - 'goreleaser/goreleaser-action@v7.2.3'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+        - 'actions/setup-node@v7.1.0'
+        - 'go-task/setup-task@v2.2.0'
+        - 'goreleaser/goreleaser-action@v7.2.3'
+        - 'pnpm/action-setup@v6.0.10'
+dependencies:
+    'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5':
+        ref: 'v6.2.0'
+        commit: 'sha1-7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-go@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-b7ad1dad31e06c5925ef5d2fc7ad053ef454303e'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-node@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-python@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97'
+        owner_id: 44036562
+        repo_id: 192625525
+    'go-task/setup-task@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-a00fbb05ce67b35648be3c78cbc9fd85354c757e'
+        owner_id: 26048825
+        repo_id: 1054141549
+    'golang/govulncheck-action@v1.1.0':
+        ref: 'v1.1.0'
+        commit: 'sha1-032d45514ae346b1db93c04b0c90b841c370344f'
+        owner_id: 4314092
+        repo_id: 636411896
+        uses:
+            - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+            - 'actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5'
+    'golangci/golangci-lint-action@v9.3.0':
+        ref: 'v9.3.0'
+        commit: 'sha1-ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a'
+        owner_id: 35628013
+        repo_id: 232539879
+    'goreleaser/goreleaser-action@v7.2.3':
+        ref: 'v7.2.3'
+        commit: 'sha1-f06c13b6b1a9625abc9e6e439d9c05a8f2190e94'
+        owner_id: 24697112
+        repo_id: 209873006
+    'hustcer/setup-nu@v3.28':
+        ref: 'v3.28'
+        commit: 'sha1-95cd3bfe252450ef7d35dd9a7ddecf3484341134'
+        owner_id: 1161607
+        repo_id: 486109928
+    'pnpm/action-setup@v6.0.10':
+        ref: 'v6.0.10'
+        commit: 'sha1-0977fd99725f1db4007ccb2928dbb4e90d06cc86'
+        owner_id: 21320719
+        repo_id: 262289747

.github/workflows/ci.yml

@@ -16,6 +16,25 @@ permissions:
   contents: read
 
 jobs:
+  verify-actions-lock:
+    name: 🔒 Verify actions lockfile
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: ⬇️ Install actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.0
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: 🔒 Verify actions lockfile
+        run: gh actions-lock --verify
+        env:
+          GH_TOKEN: ${{ github.token }}
+
   build:
     name: 🔨 Build (${{ matrix.go-version }})
     strategy:
@@ -25,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -45,15 +64,15 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: ⬇️ Setup Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@v2.2.0
 
       - name: 🧪 Test
         run: task test --output group --output-group-begin '::group::{{.TASK}}' --output-group-end '::endgroup::'
@@ -67,15 +86,15 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: 1.27.x
 
       - name: ⬇️ Setup Task
-        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        uses: go-task/setup-task@v2.2.0
 
       # zsh and pwsh are preinstalled on the runners; only fish is missing
       # (plus zsh on the Linux image).
@@ -90,7 +109,7 @@ jobs:
       # Nushell ships in no runner image and is not packaged by apt, so it comes
       # from its own release archives.
       - name: ⬇️ Install Nushell
-        uses: hustcer/setup-nu@95cd3bfe252450ef7d35dd9a7ddecf3484341134 # v3.28
+        uses: hustcer/setup-nu@v3.28
         with:
           version: "*"
 
@@ -110,15 +129,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: 🔍 Lint
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        uses: golangci/golangci-lint-action@v9.3.0
         with:
           version: v2.14.0
 
@@ -127,10 +146,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: 3.15
 
@@ -145,20 +164,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: ⬇️ Setup Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: 1.27.x
 
       - name: ⬇️ Setup Node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '24'
 
       - name: ⬇️ Setup pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+        uses: pnpm/action-setup@v6.0.10
         with:
           package_json_file: website/package.json
 
@@ -201,7 +220,7 @@ jobs:
     permissions:
       pull-requests: read
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           script: |
             // Everything cmd/release overwrites. Adding a file is fine -- that
@@ -234,4 +253,4 @@ jobs:
     name: 🛡️ Vulnerabilities
     runs-on: ubuntu-latest
     steps:
-      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+      - uses: golang/govulncheck-action@v1.1.0

.github/workflows/issue-awaiting-response.yml

@@ -11,7 +11,7 @@ jobs:
   issue-awaiting-response:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/issue-closed.yml

@@ -11,7 +11,7 @@ jobs:
   issue-closed:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/issue-experiment.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'proposal'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -26,7 +26,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'draft'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -40,7 +40,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'candidate'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -54,7 +54,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'stable'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -68,7 +68,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'released'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -88,7 +88,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'abandoned'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |
@@ -108,7 +108,7 @@ jobs:
     if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'superseded'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/issue-needs-triage.yml

@@ -11,7 +11,7 @@ jobs:
   issue-needs-triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/release-nightly.yml

@@ -13,17 +13,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        uses: actions/setup-go@v7.0.0
         with:
           go-version: 1.27.x
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
+        uses: goreleaser/goreleaser-action@v7.2.3
         with:
           distribution: goreleaser-pro
           version: latest