[tillrohrmann]

Summary

Onboards this repository to GitHub Actions workflow lockfiles as part of tightening the restatedev org's Actions policy (allow-listed actions, SHA pinning, required lockfile).

• .github/workflows/actions.lock (generated by gh actions-lock v0.4.0) pins every action, including transitive actions used inside composite actions, to a full commit SHA. This satisfies the org's "require full-length commit SHA" policy without writing SHAs into the workflows.
• uses: refs are narrowed to the exact version that is locked (e.g. @v4 → @v4.4.0).
• New verify-lockfile.yml runs gh actions-lock --verify on PRs that touch workflows or actions and on pushes to main, so the lockfile can't drift. It calls the shared workflow in restatedev/restate ([CI] Make verify-lockfile workflow reusable restate#5721), so the gh-actions-lock version is maintained in one place.
• Known non-blocking warning: the enricomi/publish-unit-test-result-action container image isn't covered by the lockfile; tracked in Track unfixable gh actions-lock container-image warnings restate#5709.

Updating actions

Change the uses: ref and run gh actions-lock (install with gh extension install github/gh-actions-lock --pin v0.4.0), then commit the updated actions.lock. Dependabot regenerates the lockfile in its PRs.

After this merges, the repository will be added to the org's Require-lockfile policy.

Test plan

• gh actions-lock --verify: all workflows valid
• Verify actions lockfile check passes on this PR

🤖 Generated with Claude Code

[github-actions]

Test Results

 6 files  ±0   6 suites  ±0   3m 20s ⏱️ +31s
46 tests ±0  46 ✅ ±0  0 💤 ±0  0 ❌ ±0 
97 runs  ±0  97 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit e49e5b4. ± Comparison against base commit 86c10ec.

♻️ This comment has been updated with latest results.

[tillrohrmann]

@pullfrog review

[pullfrog]

Important

The lockfile was generated before main gained .github/workflows/pullfrog.yml (86c10ec). Merging as-is leaves actions.lock out of sync on main, so it needs a rebase and regeneration.

Reviewed changes

This PR adds a GitHub Actions lockfile and narrows uses: refs to exact versions. Reviewed against current main.

• actions.lock — generated by gh actions-lock. Pins every action used by ci.yml, debug-runner.yml, and release.yml to a commit SHA.
• Version narrowing — each uses: ref now names the exact tag that is locked, e.g. @v4 → @v4.4.0. The narrowed refs match the lockfile entries one-to-one.
• verify-lockfile.yml — runs on PRs that touch workflows or actions, and on pushes to main. It delegates to the shared restatedev/restate reusable workflow, the same way cla.yml does.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

[pullfrog]

✅ Pullfrog addressed all of its review feedback on this PR.

I fixed the one open review thread: actions.lock now covers .github/workflows/pullfrog.yml.

• Fix: I merged main into actions-lockfile instead of rebasing, so no force push was needed. Then I regenerated the lockfile with gh actions-lock v0.4.0. It now pins actions/checkout@v6.1.0, actions/setup-java@v5.7.0, gradle/actions@v6.4.1 and pullfrog/pullfrog@v0.1.110.
• Check: gh actions-lock --verify reports all 6 workflows valid. The only warning is the known one about the enricomi/publish-unit-test-result-action container image not being pinned by digest.
• Pushed: commit e49e5b4. I replied to the thread and resolved it.

Two things are still open and not part of this fix:

• The tool says warpbuilds/action-debugger@v1.3 in debug-runner.yml is pinned without a full version number, and that the latest release is v2.0.0.
• Make sure pullfrog/pullfrog is on the org's allow-list before the Require-lockfile policy is turned on.

Task list (3/4 completed)

• Merge main into PR branch
• Regenerate actions.lock with gh actions-lock v0.4.0
• Verify, commit, push
• Reply to thread and report

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}