avantikonde · Nov 15, 2026 · Nov 15, 2026 · Nov 15, 2026
diff --git a/.changeset/actions-lockfile.md b/.changeset/actions-lockfile.md
@@ -0,0 +1,6 @@
+---
+---
+
+ci: lock the actions every workflow runs (#1117)
+
+Every `uses:` was pinned to a mutable tag, so a tag moved upstream changed what CI executed and nothing recorded what a run resolved to. `gh actions-lock` now writes `.github/workflows/actions.lock` with the commit each action resolves to, keeping the readable version in the workflow, and a `lockfile` job runs `gh actions-lock --verify` so a workflow edit that is not relocked fails. `amannn/action-semantic-pull-request@v5` needed a full version before it could lock and moved to `v5.5.3`, the same major. No runtime behaviour changes; the lock stays advisory until the repository enables Workflow lockfiles.
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
@@ -0,0 +1,114 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/changesets.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'actions/setup-node@v3.9.1'
+        - 'changesets/action@v1.9.0'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/checks.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'coverallsapp/github-action@v2.3.6'
+        - 'deblockt/cucumber-report-annotations-action@v1.7'
+        - 'dorny/paths-filter@v3.0.4'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'wagoid/commitlint-github-action@v5.5.1'
+    '.github/workflows/dependabot-changeset.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/deploy-website-preview.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'actions/setup-node@v3.9.1'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/deploy-website.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'actions/setup-node@v3.9.1'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/pr-title.yml':
+        - 'amannn/action-semantic-pull-request@v5.5.3'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v3.7.0'
+        - 'docker/build-push-action@v2.5.0'
+        - 'docker/login-action@v1.10.0'
+        - 'docker/metadata-action@v3.3.0'
+dependencies:
+    'actions/checkout@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-a37ce9120846195fa4ece8f58b268e6043cb2f26'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/setup-node@v3.9.1':
+        ref: 'v3.9.1'
+        commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-node@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'amannn/action-semantic-pull-request@v5.5.3':
+        ref: 'v5.5.3'
+        commit: 'sha1-0723387faaf9b38adef4775cd42cfd5155ed6017'
+        owner_id: 4038316
+        repo_id: 220418983
+    'changesets/action@v1.9.0':
+        ref: 'v1.9.0'
+        commit: 'sha1-a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d'
+        owner_id: 51163350
+        repo_id: 202093906
+    'coverallsapp/github-action@v2.3.6':
+        ref: 'v2.3.6'
+        commit: 'sha1-648a8eb78e6d50909eff900e4ec85cab4524a45b'
+        owner_id: 16691566
+        repo_id: 200696780
+    'deblockt/cucumber-report-annotations-action@v1.7':
+        ref: 'v1.7'
+        commit: 'sha1-152244262905d9ce2b17889606535ede6c9ab79b'
+        owner_id: 5050163
+        repo_id: 279071289
+    'docker/build-push-action@v2.5.0':
+        ref: 'v2.5.0'
+        commit: 'sha1-ad44023a93711e3deb337508980b4b5e9bcdc5dc'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v1.10.0':
+        ref: 'v1.10.0'
+        commit: 'sha1-f054a8b539a109f9f41c372932f1ae047eff08c9'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/metadata-action@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-98669ae865ea3cffbcbaa878cf57c20bbf1c6c38'
+        owner_id: 5429470
+        repo_id: 306769011
+    'dorny/paths-filter@v3.0.4':
+        ref: 'v3.0.4'
+        commit: 'sha1-0e4a8c6effa4802afeda77dc8d303f8176d7dfad'
+        owner_id: 1588572
+        repo_id: 265601040
+    'pnpm/action-setup@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
+        owner_id: 21320719
+        repo_id: 262289747
+    'wagoid/commitlint-github-action@v5.5.1':
+        ref: 'v5.5.1'
+        commit: 'sha1-9763196e10f27aef304c9b8b660d31d97fce0f99'
+        owner_id: 7467450
+        repo_id: 212203144
diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
@@ -22,14 +22,14 @@ jobs:
       # RELEASE_PAT is the environment secret this job already hands to the
       # action for its API calls; the push needs the same credential.
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PAT }}
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.3.0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v3.9.1
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -41,7 +41,7 @@ jobs:
       - run: git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: Create Release Pull Request or Publish
-        uses: changesets/action@v1
+        uses: changesets/action@v1.9.0
         with:
           version: pnpm run changeset:version
           publish: pnpm run changeset:publish

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
@@ -21,11 +21,11 @@ jobs:
     outputs:
       src: ${{ steps.filter.outputs.src }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
       - id: filter
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v3.0.4
         with:
           filters: |
             src:
@@ -53,18 +53,18 @@ jobs:
     if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
       - name: Install package dependencies
         run: pnpm install --frozen-lockfile
       - name: Run commitlint
-        uses: wagoid/commitlint-github-action@v5
+        uses: wagoid/commitlint-github-action@v5.5.1
 
   lint:
     name: Lint code
@@ -73,9 +73,9 @@ jobs:
     if: needs.changes.outputs.src == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -93,9 +93,9 @@ jobs:
     if: needs.changes.outputs.src == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -122,9 +122,9 @@ jobs:
       github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -137,7 +137,7 @@ jobs:
       - name: Run coverage for unit tests
         run: pnpm run cover:unit
         if: ${{ always() }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4.6.2
         name: Upload coverage report for unit tests
         if: ${{ always() }}
         with:
@@ -166,9 +166,9 @@ jobs:
       github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+        uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
       - name: Run integration tests
@@ -190,7 +190,7 @@ jobs:
           flag-name: Integration
           parallel: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4.6.2
         name: Upload coverage report for integration tests
         if: ${{ always() }}
         with:
@@ -221,15 +221,33 @@ jobs:
     if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4.3.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
       - name: Install package dependencies
         run: pnpm install --frozen-lockfile
       - name: Check for changeset
         run: pnpm exec changeset status --since origin/${{ github.base_ref }}
+
+  lockfile:
+    name: Actions lockfile
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      # Both steps call `gh`. The install clones over anonymous git, which
+      # works but is rate-limited; the verify resolves tags, which is a API
+      # call either way. One token for the job rather than one per step.
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4.4.0
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify the lockfile against the workflows
+        run: gh actions-lock --verify
+
diff --git a/.github/workflows/dependabot-changeset.yml b/.github/workflows/dependabot-changeset.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
         with:
           ref: ${{ github.head_ref || github.ref_name }}
           fetch-depth: 0
@@ -29,12 +29,12 @@ jobs:
           echo "title=$(gh pr view --json title --jq '.title')" >> "$GITHUB_OUTPUT"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v4.3.0
         with:
           version: 10.33.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: '24'
           cache: 'pnpm'

diff --git a/.github/workflows/deploy-website-preview.yml b/.github/workflows/deploy-website-preview.yml
@@ -91,12 +91,12 @@ jobs:
 
       - name: Checkout (for cleanup metadata)
         if: steps.guard.outputs.skip == 'false'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.3.0
         if: steps.guard.outputs.skip == 'false' && github.event.action != 'closed'
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v3.9.1
         if: steps.guard.outputs.skip == 'false' && github.event.action != 'closed'
         with:
           node-version-file: .nvmrc

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
@@ -87,11 +87,11 @@ jobs:
       # 1.1.1 has run on the tag ref — so the build is exactly the released
       # commit, even if main has advanced by the time the job starts.
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.3.0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v3.9.1
         with:
           node-version-file: .nvmrc
           cache: pnpm

diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
@@ -13,7 +13,7 @@ jobs:
     name: Lint PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v5.5.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
         # Build the code the tag names, not the branch the dispatch was started
         # from. A release event already carries the tag as GITHUB_REF, so the
         # input only overrides it; checking out `main` while pushing the image as