Workflow must use a lockfile. Run `gh actions pin <workflow-path>` to generate one. The following workflows are missing a lockfile: - .github/workflows/semgrep.yml