From 0e9ae76ea2a3d022b96ab7a464a1c437841dae99 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 9 Oct 2026 19:10:59 +0000 Subject: [PATCH] ci(lock): lock taiki-e/install-action@v2.87.26 used by mvp-smoke and s4-loop PR #412 (dependabot, actions group) bumped the workflow refs from v2.87.22 to v2.87.26 but did not update actions.lock. The lock check ('Verify immutable action lockfile') then fails on main, which is the Workflow Security Linter red since #412. The entry is the v2.87.26 tag commit (f7e5d7c), with the same owner_id and repo_id as before. No workflow references v2.87.22 any more, so that entry is replaced rather than kept. Verified: no workflow file references the unlocked ref; the change is one entry replaced in the lock. The authoritative gh-actions-lock check could not be run from the agent sandbox (its release download is outside the allow-list), so CI is the verifier. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/workflows/actions.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 091a936a..bad3397a 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -59,7 +59,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.87.22' + - 'taiki-e/install-action@v2.87.26' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.1' @@ -75,7 +75,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'dtolnay/rust-toolchain@v1' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.87.22' + - 'taiki-e/install-action@v2.87.26' '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/security-scan.yml': [] @@ -192,8 +192,8 @@ dependencies: commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 - 'taiki-e/install-action@v2.87.22': - ref: 'v2.87.22' - commit: 'sha1-83ac0ad63c0167e6f06796fab0fce28db1bf3db0' + 'taiki-e/install-action@v2.87.26': + ref: 'v2.87.26' + commit: 'sha1-f7e5d7c961414b23f5b25b2da9294395d08513ad' owner_id: 43724913 repo_id: 442947557