[tillrohrmann]

Summary

Replaces the copied job in verify-lockfile.yml with a call to the shared workflow in restatedev/restate (restatedev/restate#5721):

jobs:
  verify:
    uses: restatedev/restate/.github/workflows/verify-lockfile.yml@main

The gh-actions-lock version is then maintained in one place for all restatedev repositories. Dependabot can't bump it because it is a CLI argument (gh extension install github/gh-actions-lock --pin v0.4.0), not a uses: reference. The workflow name and triggers stay as they are.

• actions.lock is relocked: the verify-lockfile.yml entry no longer lists actions/checkout, which is now covered by restatedev/restate's own lockfile.
• The check is now reported as verify / verify instead of verify. No branch protection or ruleset in this repository requires the old name.

Test plan

• gh actions-lock relock: all workflows valid
• verify / verify passes on this PR (the shared workflow already passes in the 10 Wave 1 repositories, e.g. Add GitHub Actions workflow lockfile e2e#462)

🤖 Generated with Claude Code

[github-actions]

Test Results

  8 files  ±0    8 suites  ±0   3m 26s ⏱️ -16s
 71 tests ±0   71 ✅ ±0  0 💤 ±0  0 ❌ ±0 
322 runs  ±0  322 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 79e4c50. ± Comparison against base commit 0e9c675.

♻️ This comment has been updated with latest results.

[tillrohrmann]

@pullfrog please rebase and review

[pullfrog]

✅ No new issues found.

Rebased onto main (0e9c675, which added pullfrog.yml). The actions.lock conflict is resolved: actions/checkout@v6.1.0 stays because pullfrog.yml uses it, and actions/checkout@v7.0.1 is dropped because no workflow references it any more. gh actions-lock --verify (v0.4.0) passes locally: "All 7 workflows valid".

I checked the shared restatedev/restate/.github/workflows/verify-lockfile.yml@main. It declares workflow_call, needs no inputs or secrets, asks only for contents: read (the caller grants the same), and checks out the caller's repo with persist-credentials: false. The caller keeps its own name and triggers, so behaviour matches the job it replaces.

One thing to be aware of, not a blocker: @main is a mutable ref, and the lockfile records verify-lockfile.yml as [], so the reusable workflow itself isn't pinned here. Any change merged to restatedev/restate main runs here on the next PR. That's the point of centralising it, and the token is read-only, so the risk is low.

  ^{｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}