ci: lock workflow dependencies with GitHub's actions.lock

.github/workflows/actions.lock

@@ -0,0 +1,108 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/add-notebook-examples-to-docs.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'actions/setup-python@v4.9.1'
+        - 'peter-evans/create-pull-request@v7.0.11'
+    '.github/workflows/compile-llms-txt.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/setup-python@v4.9.1'
+    '.github/workflows/delete-bot-comments.yaml':
+        - 'actions/github-script@v6.4.1'
+    '.github/workflows/docker-mcp-publish.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'docker/build-push-action@v5.4.0'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/metadata-action@v5.10.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+    '.github/workflows/examples-integration-test.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/setup-python@v4.9.1'
+    '.github/workflows/python-publish.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'astral-sh/setup-uv@v5.4.2'
+    '.github/workflows/python-tests.yaml':
+        - 'actions/checkout@v4.4.0'
+        - 'astral-sh/setup-uv@v5.4.2'
+        - 'codecov/codecov-action@v5.5.5'
+    '.github/workflows/stale-check.yml':
+        - 'actions/stale@v9.1.0'
+    '.github/workflows/static-analysis.yaml':
+        - 'actions/checkout@v4.4.0'
+        - 'astral-sh/setup-uv@v4.2.0'
+dependencies:
+    'actions/checkout@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-a37ce9120846195fa4ece8f58b268e6043cb2f26'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea':
+        ref: 'v7.0.1'
+        commit: 'sha1-60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/github-script@v6.4.1':
+        ref: 'v6.4.1'
+        commit: 'sha1-d7906e4ad0b1822421a7e6a35d5ca353c962f410'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-python@v4.9.1':
+        ref: 'v4.9.1'
+        commit: 'sha1-7f4fc3e22c37d6ff65e88745f38bd3157c663f7c'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/stale@v9.1.0':
+        ref: 'v9.1.0'
+        commit: 'sha1-5bef64f19d7facfb25b37b414482c7164d639639'
+        owner_id: 44036562
+        repo_id: 200437066
+    'astral-sh/setup-uv@v4.2.0':
+        ref: 'v4.2.0'
+        commit: 'sha1-38f3f104447c67c051c4a08e39b64a148898af3a'
+        owner_id: 115962839
+        repo_id: 846733598
+    'astral-sh/setup-uv@v5.4.2':
+        ref: 'v5.4.2'
+        commit: 'sha1-d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86'
+        owner_id: 115962839
+        repo_id: 846733598
+    'codecov/codecov-action@v5.5.5':
+        ref: 'v5.5.5'
+        commit: 'sha1-0fb7174895f61a3b6b78fc075e0cd60383518dac'
+        owner_id: 8226205
+        repo_id: 200299178
+        uses:
+            - 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
+    'docker/build-push-action@v5.4.0':
+        ref: 'v5.4.0'
+        commit: 'sha1-ca052bb54ab0790a636c9b5f226502c73d547a25'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-c94ce9fb468520275223c153574b00df6fe4bcc9'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/metadata-action@v5.10.0':
+        ref: 'v5.10.0'
+        commit: 'sha1-c299e40c65443455700f0fdfc63efafe5b349051'
+        owner_id: 5429470
+        repo_id: 306769011
+    'docker/setup-buildx-action@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f'
+        owner_id: 5429470
+        repo_id: 288485773
+    'peter-evans/create-pull-request@v7.0.11':
+        ref: 'v7.0.11'
+        commit: 'sha1-22a9089034f40e5a961c8808d113e2c98fb63676'
+        owner_id: 18365890
+        repo_id: 197176365

.github/workflows/add-notebook-examples-to-docs.yml

@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v4.9.1
         with:
           python-version: '3.x'
 
@@ -102,7 +102,7 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v7.0.11
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           committer: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/compile-llms-txt.yml

@@ -15,12 +15,12 @@ jobs:
   compile-llms-txt:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.4.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v4.9.1
       with:
         python-version: '3.11'
 

.github/workflows/delete-bot-comments.yaml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Delete bot comment
-        uses: actions/github-script@v6
+        uses: actions/github-script@v6.4.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/docker-mcp-publish.yml

@@ -18,20 +18,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Log in to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v5.10.0
         with:
           images: |
             ${{ secrets.DOCKERHUB_USERNAME }}/agentops-mcp
@@ -42,7 +42,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v5.4.0
         with:
           context: ./mcp
           file: ./mcp/Dockerfile

.github/workflows/examples-integration-test.yml

@@ -108,10 +108,10 @@ jobs:
 
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.4.0
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v4.9.1
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/python-publish.yml

@@ -43,10 +43,10 @@ jobs:
       name: ${{ github.event_name == 'release' && 'pypi' || 'test' }}
       url: ${{ github.event_name == 'release' && 'https://pypi.org/p/agentops' || 'https://test.pypi.org/p/agentops' }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.4.0
 
     - name: Setup UV
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@v5.4.2
       with:
         python-version: "3.11"  # Specify exact version
         cache-dependency-glob: |

.github/workflows/python-tests.yaml

@@ -49,10 +49,10 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
 
       - name: Setup UV
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v5.4.2
         continue-on-error: true
         with:
           python-version: ${{ matrix.python-version }}
@@ -72,7 +72,7 @@ jobs:
       # Only upload coverage report for python3.11
       - name: Upload coverage to Codecov
         if: ${{matrix.python-version == '3.11'}}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v5.5.5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml
@@ -88,10 +88,10 @@ jobs:
       PYTHONUNBUFFERED: "1"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
 
       - name: Setup UV
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v5.4.2
         continue-on-error: true
         with:
           python-version: "3.12"

.github/workflows/stale-check.yml

@@ -12,7 +12,7 @@ jobs:
   stale-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v9.1.0
         with:
           # Only process pull requests (not issues)
           days-before-stale: 14

.github/workflows/static-analysis.yaml

@@ -32,11 +32,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@v4
+      - uses: astral-sh/setup-uv@v4.2.0
         with:
           enable-cache: true
           cache-dependency-glob: "**/pyproject.toml"