From fd83787454278046ae28e8f61dcdf0f7db6d99f9 Mon Sep 17 00:00:00 2001 From: hyperpolymath Date: Sun, 20 Sep 2026 02:04:47 +0000 Subject: [PATCH] fix(ci): key action refs already used by the workflows + actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + github/codeql-action@29b1f65c1f735799893313399435a59f54045865 Every SHA-pinned `uses:` ref in .github/workflows/ is now present in .github/workflows/actions.lock. Entry format matches gh actions-lock v0.0.2 (ref/commit/owner_id/repo_id); entries reuse the estate SSOT (hyperpolymath/standards) lock where the same ref is keyed there, owner/repo ids otherwise resolved from the GitHub API. No workflow files changed. Verified: validate-actions-lock.sh -> exit 0 (was: 2 missing ref(s)). --- .github/workflows/actions.lock | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index d11bdeb..38dd3a4 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -13,11 +13,24 @@ workflows: - 'hyperpolymath/smtp-notify-action@v0.3.0' '.github/workflows/secret-scanner.yml': [] dependencies: + 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': ref: 'v7.0.1' commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' owner_id: 44036562 repo_id: 197814629 + + 'github/codeql-action@29b1f65c1f735799893313399435a59f54045865': + ref: '29b1f65c1f735799893313399435a59f54045865' + commit: 'sha1-29b1f65c1f735799893313399435a59f54045865' + owner_id: 9919 + repo_id: 259445878 + 'hyperpolymath/smtp-notify-action@v0.3.0': ref: 'v0.3.0' commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'