Lock GitHub Actions workflows with an actions lockfile (#2096)

.github/workflows/actions.lock

@@ -0,0 +1,86 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/agent-scan.yml':
+        - 'matteogabriele/agentscan-action@v2.5.0'
+    '.github/workflows/cifuzz.yml':
+        - 'actions/upload-artifact@v7.0.2'
+        - 'github/codeql-action@v4.39.3'
+        - 'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657'
+    '.github/workflows/documentation.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+    '.github/workflows/pr-quality.yml':
+        - 'peakoss/anti-slop@v0.3.0'
+    '.github/workflows/ruff.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.1.0'
+    '.github/workflows/tests.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/setup-python@v7.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'coverallsapp/github-action@v2.3.8'
+        - 'ncipollo/release-action@v1.21.0'
+    '.github/workflows/zizmor.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.39.3'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-python@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'astral-sh/setup-uv@v10.3.3':
+        ref: 'v10.3.3'
+        commit: 'sha1-68559e99cc807c1eb7e9238fd43a15bba460eec2'
+        owner_id: 115962839
+        repo_id: 846733598
+    'coverallsapp/github-action@v2.3.8':
+        ref: 'v2.3.8'
+        commit: 'sha1-8d6379e14d29928660c4ba802d8e85393440b329'
+        owner_id: 16691566
+        repo_id: 200696780
+    'github/codeql-action@v4.39.3':
+        ref: 'v4.39.3'
+        commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066'
+        owner_id: 9919
+        repo_id: 259445878
+    'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657':
+        ref: 'master'
+        commit: 'sha1-06a694ed8ee65428f29d220a001681a19ccde657'
+        owner_id: 1342004
+        repo_id: 63809205
+    'matteogabriele/agentscan-action@v2.5.0':
+        ref: 'v2.5.0'
+        commit: 'sha1-8112fb79b33fafb8506159df20129a34209ac410'
+        owner_id: 5337152
+        repo_id: 1183120486
+    'ncipollo/release-action@v1.21.0':
+        ref: 'v1.21.0'
+        commit: 'sha1-339a81892b84b4eeb0f6e744e4574d79d0d9b8dd'
+        owner_id: 5712756
+        repo_id: 204020546
+    'peakoss/anti-slop@v0.3.0':
+        ref: 'v0.3.0'
+        commit: 'sha1-57858eead489d08b255fab2af45a506c2ca6eab2'
+        owner_id: 227272980
+        repo_id: 1153153658

.github/workflows/agent-scan.yml

@@ -30,7 +30,7 @@ jobs:
 #          key: agentscan-cache-${{ github.actor }}
 #          restore-keys: agentscan-cache-
       - name: AgentScan
-        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
+        uses: MatteoGabriele/agentscan-action@v2.5.0
         with:
 #          allowed-users: "angatha,ennamarie19,niccokunzmann,peskypotato,SashankBhamidi,stevepiercy"
           honeypot: true

.github/workflows/cifuzz.yml

@@ -21,15 +21,15 @@ jobs:
         fuzz-seconds: 600
         output-sarif: true
     - name: Upload Crash
-      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+      uses: actions/upload-artifact@v7.0.2
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
         path: ./out/artifacts
     - name: Upload Sarif
       if: always() && steps.build.outcome == 'success'
       # https://github.com/github/codeql-action/releases
-      uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
+      uses: github/codeql-action/upload-sarif@v4.39.3
       with:
         # Path to SARIF file relative to the root of the repository
         sarif_file: cifuzz-sarif/results.sarif

.github/workflows/documentation.yml

@@ -28,13 +28,13 @@
       matrix:
         python-version: ['3.11', '3.14']
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Install uv
-        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        uses: astral-sh/setup-uv@v10.3.3
         with:
           # UV_VERSION can be set in the repository settings:
           # Settings -> Secrets and variables -> Actions or click here:

.github/workflows/pr-quality.yml

@@ -17,7 +17,7 @@ jobs:
   anti-slop:
     runs-on: ubuntu-latest
     steps:
-      - uses: peakoss/anti-slop@57858eead489d08b255fab2af45a506c2ca6eab2 # v0.3.0
+      - uses: peakoss/anti-slop@v0.3.0
         with:
           max-failures: 4
           max-description-length: 1500

.github/workflows/ruff.yml

@@ -9,9 +9,9 @@
         Please set up your development environment and run the formatting command.
         https://icalendar.readthedocs.io/en/stable/contribute/development.html#format-code
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@v7.1.0
         with:
           python-version: 3.14
           cache: pip

.github/workflows/tests.yml

@@ -21,7 +21,7 @@
       # See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/passing-information-between-jobs#example-defining-outputs-for-a-job
       include: ${{ steps.set-matrix.outputs.include }}
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/checkout@v7.0.1
     - name: Set matrix
       id: set-matrix
       env:
@@ -44,13 +44,13 @@
     - name: Skip notice
       if: ${{ matrix.skip }}
       run: echo "Skipped ${{ matrix.test_name }} (not required for this trigger)"
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/checkout@v7.0.1
       if: ${{ !matrix.skip }}
       with:
         fetch-tags: true
     - name: Install uv and Python ${{ matrix.python_version }}
       if: ${{ !matrix.skip }}
-      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      uses: astral-sh/setup-uv@v10.3.3
       with:
         # zizmor: ignore[cache-poisoning] - run-tests does not produce release artifacts
         enable-cache: true
@@ -70,7 +70,7 @@
       run: ${{ matrix.test_command }}
     - name: Coveralls Parallel
       if: ${{ !matrix.skip }}
-      uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2
+      uses: coverallsapp/github-action@v2.3.8
       with:
         flag-name: run-${{ matrix.test_name }}
         parallel: true
@@ -89,7 +89,7 @@
     runs-on: ubuntu-latest
     steps:
     - name: Coveralls Finished
-      uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2
+      uses: coverallsapp/github-action@v2.3.8
       with:
         parallel-finished: true
         format: cobertura
@@ -101,18 +101,18 @@
       contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Install uv and Python
-      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      uses: astral-sh/setup-uv@v10.3.3
       with:
         enable-cache: false
         version: "0.11.6"
     - name: Check the release files
       run: make test-dist
     - name: Upload built packages
-      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      uses: actions/upload-artifact@v7.0.2
       with:
         name: built-packages
         path: dist/*
@@ -124,12 +124,12 @@
     runs-on: ubuntu-latest
     steps:
     - name: Download built packages
-      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      uses: actions/download-artifact@v8.0.2
       with:
         name: built-packages
         path: dist
     - name: Install uv and Python 3.14
-      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      uses: astral-sh/setup-uv@v10.3.3
       with:
         enable-cache: false
         # UV_VERSION can be set in the repository settings:
@@ -165,9 +165,9 @@
       TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
       TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/checkout@v7.0.1
     - name: Set up Python
-      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+      uses: actions/setup-python@v7.1.0
       with:
         python-version: "3.14"
     - name: Update pip
@@ -206,9 +206,9 @@
     environment:
       name: github-release
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@v7.0.1
       - name: Create GitHub release from tag
-        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+        uses: ncipollo/release-action@v1.21.0
         with:
           allowUpdates: true
           body: "To view the changes, please see the [Changelog](https://icalendar.readthedocs.io/en/latest/reference/changelog.html). This release can be installed from [PyPI](https://pypi.org/project/icalendar/#history)."

.github/workflows/zizmor.yml

@@ -16,17 +16,37 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Update pip
         run: scripts/update-pip.sh
       - name: Install zizmor
-        run: pip install zizmor==1.30.1  # also update pyproject.toml
+        # 1.32.0 is the first release that reads the actions lockfile
+        run: pip install zizmor==1.32.0  # also update pyproject.toml
       - name: Run zizmor
         run: zizmor --format sarif .github/workflows/ > zizmor-results.sarif
       - name: Upload SARIF file
         # https://github.com/github/codeql-action/releases
-        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
+        uses: github/codeql-action/upload-sarif@v4.39.3
         with:
           sarif_file: zizmor-results.sarif
+
+  # Fails when .github/workflows/actions.lock is out of sync with the
+  # workflows or a locked pin no longer verifies upstream.
+  # https://docs.github.com/en/actions/how-tos/administer/enforce-workflow-lockfiles
+  lockfile:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify the actions lockfile
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-actions-lock --pin v0.4.1
+          gh actions-lock --verify

news/2096.internal

@@ -0,0 +1 @@
+Locked the GitHub Actions workflows: every workflow pins its actions by version tag, with the tag-to-commit mapping recorded in ``.github/workflows/actions.lock`` and verified in CI by ``gh actions-lock --verify`` (`Issue #2096 <https://github.com/collective/icalendar/issues/2096>`_). @rahul05ranjan

pyproject.toml

@@ -103,7 +103,7 @@ dev = [
   "towncrier>=25.8.0",
   "tox",
   "tox-uv",
-  "zizmor==1.30.1", # also update .github/workflows/zizmor.yml
+  "zizmor==1.32.0; python_version >= '3.11'", # also update .github/workflows/zizmor.yml
 ]
 
 test = [