From 4bf04bce491246ffb6da525955d426e9cf4173e3 Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 22 Oct 2026 06:38:55 -0400 Subject: [PATCH] chore(ci): add GitHub Actions lockfile --- .github/workflows/actions.lock | 47 ++++++++++++++++++++++++++++++++ .github/workflows/lint.yml | 10 +++---- .github/workflows/sonarcloud.yml | 6 ++-- .github/workflows/test.yml | 4 +-- .github/workflows/zizmor.yml | 4 +-- 5 files changed, 59 insertions(+), 12 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..7c1083c --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,47 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/lint.yml': + - 'actions/checkout@v7.0.1' + - 'pnpm/setup@v3.1.1' + '.github/workflows/renovate.yml': [] + '.github/workflows/sonarcloud.yml': + - 'actions/checkout@v7.0.1' + - 'pnpm/setup@v3.1.1' + - 'sonarsource/sonarqube-scan-action@v8.3.0' + '.github/workflows/test.yml': + - 'actions/checkout@v7.0.1' + - 'pnpm/setup@v3.1.1' + '.github/workflows/zizmor.yml': + - 'actions/checkout@v7.0.1' + - 'zizmorcore/zizmor-action@v0.7.1' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2': + ref: 'v4.38.2' + commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' + owner_id: 9919 + repo_id: 259445878 + 'pnpm/setup@v3.1.1': + ref: 'v3.1.1' + commit: 'sha1-a0881977cd8ea73b1ed212236c99ca10dcc80cf4' + owner_id: 21320719 + repo_id: 1235693694 + 'sonarsource/sonarqube-scan-action@v8.3.0': + ref: 'v8.3.0' + commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9' + owner_id: 545988 + repo_id: 366408409 + 'zizmorcore/zizmor-action@v0.7.1': + ref: 'v0.7.1' + commit: 'sha1-85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e' + owner_id: 210636713 + repo_id: 985558803 + uses: + - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 677ed80..73deaef 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -17,12 +17,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1 + uses: pnpm/setup@v3.1.1 with: node-version-file: ".nvmrc" cache: true @@ -38,12 +38,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1 + uses: pnpm/setup@v3.1.1 with: node-version-file: ".nvmrc" cache: true @@ -59,7 +59,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false sparse-checkout: .github/ diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index ff78698..ce7221f 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -19,13 +19,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis persist-credentials: false - name: Setup pnpm - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1 + uses: pnpm/setup@v3.1.1 with: node-version-file: ".nvmrc" cache: true @@ -35,7 +35,7 @@ jobs: run: pnpm test:coverage - name: SonarQube Cloud Scan - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0 + uses: SonarSource/sonarqube-scan-action@v8.3.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index da0a42a..9712e32 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,12 +17,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Setup pnpm - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1 + uses: pnpm/setup@v3.1.1 with: node-version-file: ".nvmrc" cache: true diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 541611a..1156484 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -20,9 +20,9 @@ jobs: actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + uses: zizmorcore/zizmor-action@v0.7.1