Lock GitHub Actions dependencies with a workflow lockfile

.github/workflows/actions.lock

@@ -0,0 +1,180 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/bump.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'peter-evans/create-pull-request@v8.1.1'
+    '.github/workflows/cla.yml': []
+    '.github/workflows/dependency-submission.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-java@v5.7.0'
+        - 'gradle/actions@v6.4.1'
+    '.github/workflows/docker.yaml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-java@v5.7.0'
+        - 'docker/login-action@v4.7.0'
+        - 'docker/metadata-action@v5.10.0'
+        - 'gradle/actions@v6.4.1'
+    '.github/workflows/integration-ci.yaml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/setup-java@v5.7.0'
+        - 'dawidd6/action-download-artifact@v21'
+        - 'docker/setup-docker-action@v5.6.0'
+        - 'gradle/actions@v6.4.1'
+        - 'restatedev/e2e@v2.2'
+    '.github/workflows/integration.yaml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/setup-java@v5.7.0'
+        - 'dawidd6/action-download-artifact@v21'
+        - 'docker/setup-docker-action@v5.6.0'
+        - 'gradle/actions@v6.4.1'
+        - 'restatedev/e2e@v2.2'
+    '.github/workflows/native.yaml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+    '.github/workflows/publish-test-results.yml':
+        - 'enricomi/publish-unit-test-result-action@v2.25.0'
+    '.github/workflows/release-docs.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/setup-java@v5.7.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'gradle/actions@v6.4.1'
+    '.github/workflows/release.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/setup-java@v5.7.0'
+        - 'gradle/actions@v6.4.1'
+    '.github/workflows/tests.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@v1.17.0'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-java@v5.7.0'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'gradle/actions@v6.4.1'
+    '.github/workflows/verify-lockfile.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions-rust-lang/setup-rust-toolchain@v1.17.0':
+        ref: 'v1.17.0'
+        commit: 'sha1-166cdcfd11aee3cb47222f9ddb555ce30ddb9659'
+        owner_id: 103899579
+        repo_id: 482610590
+        uses:
+            - 'swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4'
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-java@v4':
+        ref: 'v4'
+        commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3'
+        owner_id: 44036562
+        repo_id: 196057608
+    'actions/setup-java@v5.7.0':
+        ref: 'v5.7.0'
+        commit: 'sha1-b6effb05e454b25005698d916606bdc6ffcbf961'
+        owner_id: 44036562
+        repo_id: 196057608
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4':
+        ref: 'v4'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dawidd6/action-download-artifact@v21':
+        ref: 'v21'
+        commit: 'sha1-b6e2e70617bc3265edd6dab6c906732b2f1ae151'
+        owner_id: 9713907
+        repo_id: 239218448
+    'docker/login-action@v4.7.0':
+        ref: 'v4.7.0'
+        commit: 'sha1-81c6f93d4bc991e510b342a00b419b3bb4efc5c6'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/metadata-action@v5.10.0':
+        ref: 'v5.10.0'
+        commit: 'sha1-c299e40c65443455700f0fdfc63efafe5b349051'
+        owner_id: 5429470
+        repo_id: 306769011
+    'docker/setup-docker-action@v5.6.0':
+        ref: 'v5.6.0'
+        commit: 'sha1-7ec28a010822b4626af4874f9448a4b05ac6f3e5'
+        owner_id: 5429470
+        repo_id: 398780917
+    'enricomi/publish-unit-test-result-action@v2':
+        ref: 'v2'
+        commit: 'sha1-7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d'
+        owner_id: 44700269
+        repo_id: 290227969
+    'enricomi/publish-unit-test-result-action@v2.25.0':
+        ref: 'v2.25.0'
+        commit: 'sha1-7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d'
+        owner_id: 44700269
+        repo_id: 290227969
+    'gradle/actions@v6.4.1':
+        ref: 'v6.4.1'
+        commit: 'sha1-8da46b539cd8fe6ab27ca75128919a18d757604c'
+        owner_id: 124156
+        repo_id: 743626948
+    'peter-evans/create-pull-request@v8.1.1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'restatedev/e2e@v2.2':
+        ref: 'v2.2'
+        commit: 'sha1-edd926b59e51af418b95c143220c0a2a62b7fd7b'
+        owner_id: 97341811
+        repo_id: 489007488
+        uses:
+            - 'actions/setup-java@v4'
+            - 'actions/upload-artifact@v4'
+            - 'enricomi/publish-unit-test-result-action@v2'
+    'swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4':
+        ref: 'v2.9.1'
+        commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4'
+        owner_id: 580492
+        repo_id: 298565987

.github/workflows/bump.yaml

@@ -11,13 +11,13 @@ jobs:
     name: Bump release version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
       - name: Install dasel
         run: curl -sSLf "https://github.com/tomwright/dasel/releases/download/v2.8.1/dasel_linux_amd64" -L -o dasel && chmod +x dasel && mv ./dasel /usr/local/bin/dasel
       - name: Bump version overwriting libs.versions.toml
         run: dasel put -f gradle/libs.versions.toml -t string -v "${{ github.event.inputs.version }}" 'versions.restate'
       - name: Create version bump PR
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@v8.1.1
         with:
           title: "[Release] Bump to ${{ github.event.inputs.version }}"
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dependency-submission.yml

@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: 25
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
         with:
           cache-workspaces: sdk-core/src/main/rust
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@v6
+        uses: gradle/actions/dependency-submission@v6.4.1

.github/workflows/docker.yaml

@@ -24,34 +24,34 @@ jobs:
         jreVersion: [ 17, 21, 25 ]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
         with:
           repository: restatedev/sdk-java
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: '25'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.4.1
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
         with:
           cache-workspaces: sdk-core/src/main/rust
 
       - name: Log into GitHub container registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.7.0
         with:
           registry: ${{ env.GHCR_REGISTRY }}
           username: ${{ env.GHCR_REGISTRY_USERNAME }}
           password: ${{ env.GHCR_REGISTRY_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v5.10.0
         with:
           images: |
             ghcr.io/restatedev/test-services-java

.github/workflows/integration-ci.yaml

@@ -37,12 +37,12 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
         with:
           repository: restatedev/sdk-java
 
       - name: Set up Docker containerd snapshotter
-        uses: docker/setup-docker-action@v5
+        uses: docker/setup-docker-action@v5.6.0
         with:
           version: "v28.5.2"
           set-host: true
@@ -59,7 +59,7 @@ jobs:
       # We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call
       - name: Download restate snapshot from in-progress workflow
         if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.2
         with:
           name: restate.tar
       # In the workflow dispatch case where the artifact was created in a previous run, we can download as normal
@@ -80,18 +80,18 @@ jobs:
 
       - name: Setup Java
         if: ${{ inputs.serviceImage == '' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: '25'
 
       - name: Setup Gradle
         if: ${{ inputs.serviceImage == '' }}
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.4.1
 
       - name: Install Rust toolchain
         if: ${{ inputs.serviceImage == '' }}
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
         with:
           cache-workspaces: sdk-core/src/main/rust
 

.github/workflows/integration.yaml

@@ -47,12 +47,12 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
         with:
           repository: restatedev/sdk-java
 
       - name: Set up Docker containerd snapshotter
-        uses: docker/setup-docker-action@v5
+        uses: docker/setup-docker-action@v5.6.0
         with:
           version: "v28.5.2"
           set-host: true
@@ -69,7 +69,7 @@ jobs:
       # We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call
       - name: Download restate snapshot from in-progress workflow
         if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.2
         with:
           name: restate.tar
       # In the workflow dispatch case where the artifact was created in a previous run, we can download as normal
@@ -90,18 +90,18 @@ jobs:
 
       - name: Setup Java
         if: ${{ inputs.serviceImage == '' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
           java-version: '25'
 
       - name: Setup Gradle
         if: ${{ inputs.serviceImage == '' }}
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.4.1
 
       - name: Install Rust toolchain
         if: ${{ inputs.serviceImage == '' }}
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
         with:
           cache-workspaces: sdk-core/src/main/rust
 

.github/workflows/native.yaml

@@ -54,10 +54,10 @@ jobs:
             cross: false
             rustflags: ""
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1.17.0
         with:
           target: ${{ matrix.target }}
           cache-workspaces: sdk-core/src/main/rust
@@ -120,7 +120,7 @@ jobs:
           cp "${{ steps.lib.outputs.file }}" "$dest/"
 
       - name: Upload native library
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: native-${{ matrix.classifier }}
           path: native-staging

.github/workflows/publish-test-results.yml

@@ -30,7 +30,7 @@ jobs:
           done
 
       - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@v2.25.0
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           event_file: artifacts/Event File/event.json