feat(ci): actions.lock via the standards canonical process (D4)

.github/workflows/actions.lock

@@ -0,0 +1,107 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/boj-build.yml':
+        - 'actions/checkout@v4.1.7'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.1.1'
+        - 'actions/configure-pages@v5.0.0'
+        - 'actions/deploy-pages@v4.0.5'
+        - 'actions/upload-pages-artifact@v3.0.1'
+        - 'haskell-actions/setup@v2.7.5'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v4.1.1'
+        - 'github/codeql-action@v3.37.3'
+    '.github/workflows/governance.yml': []
+    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/deploy-pages@v4.0.5'
+        - 'actions/upload-pages-artifact@v3.0.1'
+    '.github/workflows/push-email-notify.yml':
+        - 'dawidd6/action-send-mail@v3.12.0'
+    '.github/workflows/quality-gates.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'dtolnay/rust-toolchain@v1'
+    '.github/workflows/secret-scanner.yml': []
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@v4.1.1'
+dependencies:
+    'actions/cache@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v4.1.1':
+        ref: 'v4.1.1'
+        commit: 'sha1-b4ffde65f46336ab88eb53be808477a3936bae11'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.1.7':
+        ref: 'v4.1.7'
+        commit: 'sha1-692973e3d937129bcbf40652eb9f2f61becf3332'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-983d7736d9b0ae728b81ab479565c72886d7745b'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v4.0.5':
+        ref: 'v4.0.5'
+        commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/upload-artifact@v4':
+        ref: 'v4'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v3.0.1':
+        ref: 'v3.0.1'
+        commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@v4'
+    'dawidd6/action-send-mail@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde'
+        owner_id: 9713907
+        repo_id: 222439721
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
+        owner_id: 1940490
+        repo_id: 260749683
+    'github/codeql-action@v3.37.3':
+        ref: 'v3.37.3'
+        commit: 'sha1-4187e74d05793876e9989daffde9c3e66b4acd07'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@v2.7.5':
+        ref: 'v2.7.5'
+        commit: 'sha1-ec49483bfc012387b227434aba94f59a6ecd0900'
+        owner_id: 75048950
+        repo_id: 623796603
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305

.github/workflows/boj-build.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@v4.1.7
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/workflows/casket-pages.yml

@@ -18,19 +18,19 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
       - name: Checkout casket-ssg
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
       - name: Setup GHCup
-        uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
+        uses: haskell-actions/setup@v2.7.5
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
       - name: Cache Cabal
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4.3.0
         with:
           path: |
             ~/.cabal/packages
@@ -88,9 +88,9 @@ jobs:
           cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
       - name: Setup Pages
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+        uses: actions/configure-pages@v5.0.0
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        uses: actions/upload-pages-artifact@v3.0.1
         with:
           path: '_site'
   deploy:
@@ -103,4 +103,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@v4.0.5

.github/workflows/codeql.yml

@@ -30,16 +30,16 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4.1.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        uses: github/codeql-action/init@v3.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        uses: github/codeql-action/autobuild@v3.37.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3
+        uses: github/codeql-action/analyze@v3.37.3

.github/workflows/instant-sync.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Propagation
-        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
+        uses: peter-evans/repository-dispatch@v4.0.1
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm

.github/workflows/pages.yml

@@ -20,9 +20,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -39,7 +39,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        uses: actions/upload-pages-artifact@v3.0.1
         with:
           path: '_site'
   deploy:
@@ -52,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@v4.0.5

.github/workflows/push-email-notify.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        uses: dawidd6/action-send-mail@v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}

.github/workflows/quality-gates.yml

@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@v4.3.1
       - name: Install system dependencies
         run: |
           sudo apt-get update
@@ -28,9 +28,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@v4.3.1
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        # v1 tag, not a SHA: dtolnay force-moves toolchain branches, so no
+        # symbolic ref contains the old pin and lockfile generation refuses it.
+        # The actions.lock records the resolved SHA; the toolchain must be an
+        # explicit input because the ref no longer selects it.
+        uses: dtolnay/rust-toolchain@v1
+        with:
+          toolchain: stable
       - name: Install system dependencies
         run: |
           sudo apt-get update

.github/workflows/workflow-linter.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/checkout@v4.1.1
       - name: Check SPDX headers
         run: |
           errors=0