Lock workflow action dependencies

.github/renovate.json5

@@ -21,6 +21,21 @@
     labels: ["dependencies", "security"],
   },
   packageRules: [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchDepTypes": [
+        "action"
+      ],
+      "matchFileNames": [
+        ".github/workflows/ci.yml",
+        ".github/workflows/lockfile-maintenance.yml",
+        ".github/workflows/release.yml",
+        ".github/workflows/actions-lock.yml"
+      ],
+      "pinDigests": false
+    },
     {
       matchUpdateTypes: ["major"],
       addLabels: ["dependencies:major"],

.github/workflows/actions-lock.yml

@@ -0,0 +1,29 @@
+name: Verify action lockfile
+on:
+  pull_request: null
+  push:
+    branches:
+      - main
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/[email protected]
+        with:
+          egress-policy: audit
+      - uses: actions/[email protected]
+        with:
+          persist-credentials: false
+      - name: Verify workflow dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-actions-lock --pin v0.4.0
+          gh actions-lock --verify

.github/workflows/actions.lock

@@ -0,0 +1,40 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actions-lock.yml':
+        - 'actions/[email protected]'
+        - 'step-security/[email protected]'
+    '.github/workflows/ci.yml':
+        - 'actions/[email protected]'
+        - 'actions/[email protected]'
+        - 'pnpm/[email protected]'
+        - 'step-security/[email protected]'
+    '.github/workflows/lockfile-maintenance.yml': []
+    '.github/workflows/release.yml':
+        - 'actions/[email protected]'
+        - 'actions/[email protected]'
+        - 'pnpm/[email protected]'
+        - 'step-security/[email protected]'
+dependencies:
+    'actions/[email protected]':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/[email protected]':
+        ref: 'v7.1.0'
+        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
+        owner_id: 44036562
+        repo_id: 189476904
+    'pnpm/[email protected]':
+        ref: 'v6.1.0'
+        commit: 'sha1-ea17c68df8912ef543352723c149a84f56e3d413'
+        owner_id: 21320719
+        repo_id: 262289747
+    'step-security/[email protected]':
+        ref: 'v2.22.2'
+        commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2'
+        owner_id: 88700172
+        repo_id: 422287306

.github/workflows/ci.yml

@@ -19,17 +19,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2  # v2.22.2
+        uses: step-security/[email protected]
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/[email protected]
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413  # v6.1.0
+      - uses: pnpm/[email protected]
 
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
+      - uses: actions/[email protected]
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -51,17 +51,17 @@ jobs:
         browser: [chrome, edge, firefox]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2  # v2.22.2
+        uses: step-security/[email protected]
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/[email protected]
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413  # v6.1.0
+      - uses: pnpm/[email protected]
 
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
+      - uses: actions/[email protected]
         with:
           node-version-file: .nvmrc
           cache: pnpm

.github/workflows/lockfile-maintenance.yml

@@ -8,6 +8,13 @@ permissions:
   id-token: write
 jobs:
   maintenance:
-    uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@3d087d142fbe60099a43d649279de30c02f94731 # v2.1.2
+    uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@bfe008c400f3507b5e60a6090038d5cfb72261c8 # v2.2.0
     with:
       files: /pnpm-lock.yaml
+
+  actions-lock:
+    uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@bfe008c400f3507b5e60a6090038d5cfb72261c8
+    with:
+      files: /.github/workflows/actions.lock
+      minimum-release-age: 7 days
+      branch: automation/actions-lock-maintenance

.github/workflows/release.yml

@@ -26,19 +26,19 @@ jobs:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2  # v2.22.2
+        uses: step-security/[email protected]
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/[email protected]
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413  # v6.1.0
+      - uses: pnpm/[email protected]
 
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
+      - uses: actions/[email protected]
         with:
           node-version-file: .nvmrc
           cache: pnpm