From 8d78edfe70492b68b0033ebeea85fbb8f928bc42 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 20 Sep 2026 02:02:27 +0000
Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock
 (gh-actions-lock v0.1.6)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`actions.lock` is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — `startup_failure`, "Invalid lockfile".

Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.
---
 .github/workflows/agda.yml              | 6 +++---
 .github/workflows/codeql.yml            | 6 +++---
 .github/workflows/push-email-notify.yml | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/agda.yml b/.github/workflows/agda.yml
index 5eae0ed..7e924e7 100644
--- a/.github/workflows/agda.yml
+++ b/.github/workflows/agda.yml
@@ -34,7 +34,7 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git ripgrep agda-bin=2.6.4.3-1+b2
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Verify toolchain and proof constructions
@@ -53,11 +53,11 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git agda-bin=2.6.4.3-1+b2 agda-stdlib=2.1-4
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Checkout reviewed canonical Echo source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@v6.0.3
         with:
           repository: hyperpolymath/echo-types
           ref: 46cd1a32d4dcf1020f01dd1aab41f816742da10e
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e9e8a5b..a6cd26d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,15 +42,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@v6.0.3
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/init@v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+        uses: github/codeql-action/analyze@v4.36.2
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 15ffd57..676f498 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -40,7 +40,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7  # v0.2.0
+        uses: hyperpolymath/smtp-notify-action@v0.2.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}