From b408a5fbe5a41364e66aa5711e02e63ab062bc2b Mon Sep 17 00:00:00 2001
From: Akinori Musha <knu@idaemons.org>
Date: Mon, 2 Nov 2026 21:06:28 +0900
Subject: [PATCH] Lock workflow action dependencies

Track direct and transitive action commits in actions.lock and verify
coverage and provenance in CI.  Preserve existing action versions except
for the approved maintenance Action v2 adoption.
---
 .github/workflows/actions-lock.yml | 29 +++++++++++++++++++++++++++++
 .github/workflows/actions.lock     | 22 ++++++++++++++++++++++
 .github/workflows/release.yml      |  4 ++--
 3 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/actions-lock.yml
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions-lock.yml b/.github/workflows/actions-lock.yml
new file mode 100644
index 0000000..e51de62
--- /dev/null
+++ b/.github/workflows/actions-lock.yml
@@ -0,0 +1,29 @@
+name: Verify action lockfile
+on:
+  pull_request: null
+  push:
+    branches:
+      - master
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify workflow dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-actions-lock --pin v0.4.0
+          gh actions-lock --verify
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..c48771e
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,22 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actions-lock.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/harden-runner@v2.22.2':
+        ref: 'v2.22.2'
+        commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2'
+        owner_id: 88700172
+        repo_id: 422287306
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fee46d..b3c1f3c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,12 +19,12 @@ jobs:
       contents: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@v2.22.2
         with:
           egress-policy: audit
 
       - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false