[idelsink]

Why

Our org requires every action to be pinned to a full commit SHA. That rule also covers the actions that other actions use inside them (transitive dependencies). We do not control those inner pins: when an upstream action pins one of its own actions to a version tag, our pipeline fails, even when this repo pins everything by SHA. The lockfile records the SHA of every action, also the inner ones, and GitHub accepts it as SHA pinning.

We will soon turn on the org-wide GitHub policy "Require lockfile". After that, a workflow that is not in this lockfile cannot run. Please keep actions.lock up to date when you change a workflow. Docs: https://docs.github.com/en/actions/concepts/security/workflow-dependency-lockfiles

How

• Adds .github/workflows/actions.lock, generated with gh actions-lock --no-interactive --migrate-local-actions --no-narrow (github/gh-actions-lock v0.4.1). Renovate updates the lockfile in its own PRs.
• Rewrites 17 lines in 9 files from uses: ./.github/actions/x to uses: $/.github/actions/x. $/ is the GitHub syntax for an action in the same repo at the running commit. The lockfile needs it to lock the actions that a local action uses. The same change ran green on our runners in the dsb repo (PR 246).

Docs: https://docs.github.com/actions/concepts/security/workflow-dependency-lockfiles

Verified

• gh actions-lock --verify-local passes: all 21 workflows have complete lockfile coverage.
• This repo is public, so the org lint check does not run here. gh actions-lock --verify passes locally.
• The diff of the workflows has only the ./ to $/ lines.

Not verified

• Workflows that this PR does not trigger (for example on push to the default branch, on a schedule or on release) did not run with the lockfile.

Replaces #159. The branch name ci/actions-lock did not match the branch-name rule of this repo, and a branch rename closes the pull request. The commit is the same.

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/actions-lock → main

View scan in OX Security →

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud