From 7335a91012c6fb64a36c08b6cf3aa5ff0c37e793 Mon Sep 17 00:00:00 2001
From: Akinori Musha <knu@idaemons.org>
Date: Mon, 2 Nov 2026 21:06:29 +0900
Subject: [PATCH] Lock workflow action dependencies

Track direct and transitive action commits in actions.lock and verify
coverage and provenance in CI.  Preserve existing action versions except
for the approved maintenance Action v2 adoption.
---
 .github/workflows/actions-lock.yml | 29 +++++++++++++++++++++++++++++
 .github/workflows/actions.lock     | 22 ++++++++++++++++++++++
 .github/workflows/release.yml      |  4 ++--
 3 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/actions-lock.yml
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions-lock.yml b/.github/workflows/actions-lock.yml
new file mode 100644
index 0000000..e51de62
--- /dev/null
+++ b/.github/workflows/actions-lock.yml
@@ -0,0 +1,29 @@
+name: Verify action lockfile
+on:
+  pull_request: null
+  push:
+    branches:
+      - master
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify workflow dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-actions-lock --pin v0.4.0
+          gh actions-lock --verify
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..c48771e
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,22 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actions-lock.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/harden-runner@v2.22.2':
+        ref: 'v2.22.2'
+        commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2'
+        owner_id: 88700172
+        repo_id: 422287306
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9dd8e7f..dab941f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,12 +19,12 @@ jobs:
       contents: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@v2.22.2
         with:
           egress-policy: audit
 
       - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false