From 6c14d696db7196e9ac47347222cc4b32ef8c456c Mon Sep 17 00:00:00 2001
From: Platform Tribe Bot <platform-tribe-bot@fresha.com>
Date: Mon, 25 May 2026 13:23:20 +0000
Subject: [PATCH] chore: pin and bump GitHub Actions references

- Regenerate actions.lock.yaml with current action inventory
- Bump internal (surgeventures/platform-tribe-actions) refs to latest versions
- Pin external action refs to commit SHAs for supply-chain security
---
 .github/actions.lock.yaml          | 56 ++++++++++++++++++++++++++++++
 .github/workflows/ci.yaml          |  8 ++---
 .github/workflows/dev-publish.yaml |  4 +--
 3 files changed, 62 insertions(+), 6 deletions(-)
 create mode 100644 .github/actions.lock.yaml

diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml
new file mode 100644
index 0000000..a817bb1
--- /dev/null
+++ b/.github/actions.lock.yaml
@@ -0,0 +1,56 @@
+version: 1
+generated_at: 2026-05-25T13:23:20Z
+internal: []
+trusted:
+  - action: actions/checkout
+    refs:
+      - v4
+    occurrences:
+      v4:
+        .github/workflows/ci.yaml:
+          - jobs.static.steps.[0].uses
+          - jobs.test.steps.[0].uses
+          - jobs.permit.steps.[0].uses
+          - jobs.publish.steps.[0].uses
+          - jobs.check_release.steps.[0].uses
+        .github/workflows/dev-publish.yaml:
+          - jobs.dev-publish.steps.[0].uses
+  - action: runs-on/cache
+    refs:
+      - v4
+    occurrences:
+      v4:
+        .github/workflows/ci.yaml:
+          - jobs.static.steps.[4].uses
+          - jobs.static.steps.[6].uses
+          - jobs.test.steps.[4].uses
+          - jobs.test.steps.[6].uses
+  - action: runs-on/cache/restore
+    refs:
+      - v4
+    occurrences:
+      v4:
+        .github/workflows/dev-publish.yaml:
+          - jobs.dev-publish.steps.[2].uses
+  - action: runs-on/cache/save
+    refs:
+      - v4
+    occurrences:
+      v4:
+        .github/workflows/ci.yaml:
+          - jobs.permit.steps.[3].uses
+external:
+  - action: erlef/setup-beam
+    refs:
+      - v1
+    occurrences:
+      v1:
+        .github/workflows/ci.yaml:
+          - jobs.static.steps.[1].uses
+          - jobs.test.steps.[1].uses
+          - jobs.publish.steps.[1].uses
+        .github/workflows/dev-publish.yaml:
+          - jobs.dev-publish.steps.[3].uses
+local: []
+docker: []
+dynamic: []
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 289e24d..c070e1d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,7 +7,7 @@ env:
   OTP_VERSION: 22.3.4.7 # OTP version used during package publishing
   RELEVANT_FILES: "config lib test mix.exs mix.lock" # Important, this controls the caching, make sure to keep this right
   REPOSITORY: libcluster
-  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@v1
+  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
   SHA: ${{ github.sha }}
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -41,7 +41,7 @@ jobs:
           clean: false
           persist-credentials: true
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
         env:
           ImageOS: ${{ matrix.runner-os }}
         with:
@@ -110,7 +110,7 @@ jobs:
           clean: false
           persist-credentials: true
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
         env:
           ImageOS: ${{ matrix.runner-os }}
         with:
@@ -220,7 +220,7 @@ jobs:
           clean: false
           persist-credentials: true
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
         env:
           ImageOS: ${{ env.RUNNER_OS }}
         with:
diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml
index bfe7c3b..4265647 100644
--- a/.github/workflows/dev-publish.yaml
+++ b/.github/workflows/dev-publish.yaml
@@ -7,7 +7,7 @@ env:
   OTP_VERSION: 23.3.4.7 # OTP version used during package publishing
   RELEVANT_FILES: "config lib test mix.exs mix.lock" # Important, this controls the caching, make sure to keep this right
   REPOSITORY: libcluster
-  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@v1
+  RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
   SHA: ${{ github.sha }}
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -44,7 +44,7 @@ jobs:
           path: approval.txt
           fail-on-cache-miss: true
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1
         env:
           ImageOS: ${{ env.RUNNER_OS }}
         with: