From 9dc453e7a4a605bcf6bb2bc5a8d204dc44ef3b98 Mon Sep 17 00:00:00 2001
From: Akinori Musha <knu@idaemons.org>
Date: Mon, 2 Nov 2026 21:06:27 +0900
Subject: [PATCH] Lock workflow action dependencies

Track direct and transitive action commits in actions.lock and verify
coverage and provenance in CI.  Preserve existing action versions except
for the approved maintenance Action v2 adoption.
---
 .github/workflows/actions-lock.yml | 29 +++++++++++++++++++++++++++++
 .github/workflows/actions.lock     | 22 ++++++++++++++++++++++
 .github/workflows/release.yml      |  4 ++--
 3 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/actions-lock.yml
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions-lock.yml b/.github/workflows/actions-lock.yml
new file mode 100644
index 0000000..e51de62
--- /dev/null
+++ b/.github/workflows/actions-lock.yml
@@ -0,0 +1,29 @@
+name: Verify action lockfile
+on:
+  pull_request: null
+  push:
+    branches:
+      - master
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify workflow dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-actions-lock --pin v0.4.0
+          gh actions-lock --verify
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..c48771e
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,22 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actions-lock.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/harden-runner@v2.22.2':
+        ref: 'v2.22.2'
+        commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2'
+        owner_id: 88700172
+        repo_id: 422287306
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2037154..b8b73cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,12 +19,12 @@ jobs:
       contents: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@v2.22.2
         with:
           egress-policy: audit
 
       - name: Check out source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false