ci(repo): add GitHub Actions lockfile and fix two unverifiable pins

.changeset/pin-actions-lockfile.md

@@ -0,0 +1,2 @@
+---
+---

.github/actionlint.yaml

@@ -7,3 +7,9 @@ self-hosted-runner:
   labels:
     - blacksmith-8vcpu-ubuntu-2204
     - blacksmith-6vcpu-macos-26
+
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # `$/` self-repo action syntax; unsupported by actionlint 1.7.12 (rhysd/actionlint#711)
+      - 'specifying action "\$/[^"]*" in invalid format because ref is missing'

.github/actions/init-blacksmith/action.yml

@@ -48,7 +48,7 @@ runs:
   steps:
     - name: Configure Turborepo
       id: turbo
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@v7.1.0
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
       run: echo $TURBO_ARGS
 
     - name: Install PNPM
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      uses: pnpm/action-setup@v4.3.0
 
     - name: Setup NodeJS ${{ inputs.node-version }}
-      uses: useblacksmith/setup-node@65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391 # v5
+      uses: useblacksmith/setup-node@v5.0.4
       with:
         cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
         node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
 
     - name: Cache Playwright Binaries
       if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
-      uses: useblacksmith/cache@71c7c918062ba3861252d84b07fe5ab2a6b467a6 # v5
+      uses: useblacksmith/cache@v5
       id: playwright-cache
       with:
         path: ~/.cache/ms-playwright

.github/actions/init/action.yml

@@ -48,7 +48,7 @@ runs:
   steps:
     - name: Configure Turborepo
       id: turbo
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@v7.1.0
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
       run: echo $TURBO_ARGS
 
     - name: Install PNPM
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      uses: pnpm/action-setup@v4.3.0
 
     - name: Setup NodeJS ${{ inputs.node-version }}
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@v4.4.0
       with:
         cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
         node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
 
     - name: Cache Playwright Binaries
       if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@v4.3.0
       id: playwright-cache
       with:
         path: ~/.cache/ms-playwright

.github/workflows/actionlint.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           show-progress: false
@@ -41,3 +41,26 @@ jobs:
           SHELLCHECK_OPTS: --exclude=SC2086,SC2129,SC2162
         with:
           args: -color
+
+  actions-lock:
+    name: Verify actions lockfile
+    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
+    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4.4.0
+        with:
+          persist-credentials: false
+          show-progress: false
+          sparse-checkout: .github
+          sparse-checkout-cone-mode: false
+
+      - name: Install gh-actions-lock
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install github/gh-actions-lock --pin v0.2.0
+
+      - name: Verify every workflow dependency is locked
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh actions-lock --verify

.github/workflows/actions.lock

@@ -0,0 +1,229 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actionlint.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/api-changes.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'clerk/break-check@v0.6.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/ci.yml':
+        - 'actions-cool/check-user-permission@v2.4.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/e2e-cleanups.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/e2e-staging.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'slackapi/slack-github-action@v1.27.1'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/electron-passkeys.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/expo-native-build.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/setup-java@v4.9.1'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'gradle/actions@v6.3.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'reactivecircus/android-emulator-runner@v2.38.0'
+    '.github/workflows/labeler-apply.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/labeler@v6.2.0'
+    '.github/workflows/labeler.yml':
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/lock-threads.yml':
+        - 'actions/stale@v9.1.0'
+        - 'dessant/lock-threads@v4.0.1'
+    '.github/workflows/major-version-check.yml':
+        - 'actions/github-script@v7.1.0'
+    '.github/workflows/nightly-checks.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'ravsamhq/notify-slack-action@1.10.0'
+    '.github/workflows/pr-title-linter.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/release-preflight.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/release.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'changesets/action@v1.8.0'
+        - 'dawidd6/action-download-artifact@v21'
+        - 'peter-evans/create-or-update-comment@v3.1.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'slackapi/slack-github-action@v1.27.1'
+    '.github/workflows/validate-renovate-config.yml':
+        - 'actions/checkout@v4.4.0'
+dependencies:
+    'actions-cool/check-user-permission@v2.4.0':
+        ref: 'v2.4.0'
+        commit: 'sha1-c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e'
+        owner_id: 73879334
+        repo_id: 344485868
+    'actions/cache@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/github-script@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-f28e40c7f34bde8b3046d885e986cb6290c5673b'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/labeler@v6.2.0':
+        ref: 'v6.2.0'
+        commit: 'sha1-b8dd2d9be0f68b860e7dae5dae7d772984eacd6d'
+        owner_id: 44036562
+        repo_id: 177139928
+    'actions/setup-java@v4.9.1':
+        ref: 'v4.9.1'
+        commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3'
+        owner_id: 44036562
+        repo_id: 196057608
+    'actions/setup-node@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/stale@v9.1.0':
+        ref: 'v9.1.0'
+        commit: 'sha1-5bef64f19d7facfb25b37b414482c7164d639639'
+        owner_id: 44036562
+        repo_id: 200437066
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'changesets/action@v1.8.0':
+        ref: 'v1.8.0'
+        commit: 'sha1-63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b'
+        owner_id: 51163350
+        repo_id: 202093906
+    'clerk/break-check@v0.6.0':
+        ref: 'v0.6.0'
+        commit: 'sha1-92be9cc726c848b9567c7b869e9b11dc761ddd6e'
+        owner_id: 49538330
+        repo_id: 1140987013
+        uses:
+            - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+            - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+    'dawidd6/action-download-artifact@v21':
+        ref: 'v21'
+        commit: 'sha1-b6e2e70617bc3265edd6dab6c906732b2f1ae151'
+        owner_id: 9713907
+        repo_id: 239218448
+    'dessant/lock-threads@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-be8aa5be94131386884a6da4189effda9b14aa21'
+        owner_id: 7513068
+        repo_id: 113918130
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
+        owner_id: 1940490
+        repo_id: 260749683
+    'gradle/actions@v6.3.0':
+        ref: 'v6.3.0'
+        commit: 'sha1-9c971963bec38e04b3d30dcc455b5382be2fdbfb'
+        owner_id: 124156
+        repo_id: 743626948
+    'peter-evans/create-or-update-comment@v3.1.0':
+        ref: 'v3.1.0'
+        commit: 'sha1-23ff15729ef2fc348714a3bb66d2f655ca9066f2'
+        owner_id: 18365890
+        repo_id: 223708643
+    'pnpm/action-setup@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
+        owner_id: 21320719
+        repo_id: 262289747
+    'ravsamhq/notify-slack-action@1.10.0':
+        ref: '1.10.0'
+        commit: 'sha1-4ed28566c2bdcdaee6dca2b46b9666d01b4ed8a4'
+        owner_id: 56475783
+        repo_id: 280818415
+    'reactivecircus/android-emulator-runner@v2.38.0':
+        ref: 'v2.38.0'
+        commit: 'sha1-a421e43855164a8197daf9d8d40fe71c6996bb0d'
+        owner_id: 51352484
+        repo_id: 219782401
+    'slackapi/slack-github-action@v1.27.1':
+        ref: 'v1.27.1'
+        commit: 'sha1-fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3'
+        owner_id: 6962987
+        repo_id: 306439799
+    'swatinem/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
+        owner_id: 580492
+        repo_id: 298565987
+    'useblacksmith/cache@v5':
+        ref: 'v5'
+        commit: 'sha1-71c7c918062ba3861252d84b07fe5ab2a6b467a6'
+        owner_id: 156274793
+        repo_id: 746418836
+    'useblacksmith/setup-node@v5.0.4':
+        ref: 'v5.0.4'
+        commit: 'sha1-65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391'
+        owner_id: 156274793
+        repo_id: 753445610

.github/workflows/api-changes.yml

@@ -92,14 +92,14 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           filter: 'blob:none'
           show-progress: false
 
       - name: Setup
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -115,7 +115,7 @@ jobs:
             --output "$GITHUB_WORKSPACE/.api-snapshots-baseline"
 
       - name: Upload baseline artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: break-check-baseline
           path: .api-snapshots-baseline
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           # Check out the PR head commit, not the refs/pull/N/merge ref that
           # checkout resolves by default (it absorbs base-branch drift, so once
@@ -161,7 +161,7 @@ jobs:
           show-progress: false
 
       - name: Setup
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -176,7 +176,7 @@ jobs:
         run: echo "BREAK_CHECK_FILTERS=$BREAK_CHECK_FILTERS" >> "$GITHUB_ENV"
 
       - name: Break Check
-        uses: clerk/break-check@92be9cc726c848b9567c7b869e9b11dc761ddd6e # v0.6.0
+        uses: clerk/break-check@v0.6.0
         with:
           break-check-version: '0.6.0'
           # The PR head is already checked out, so build it in place rather than