feat(rulesets): a committed applier for the canonical tag ruleset #25

	# This workflow is managed by gh actions-lock.
	# SPDX-License-Identifier: MPL-2.0
	# Fail closed when .github/workflows/actions.lock drifts from the workflows.
	#
	# This repo's .githooks validators ran ONLY in pre-commit, and Dependabot
	# never runs pre-commit -- which is exactly how a codeql-action bump landed
	# in three reusable workflows without regenerating the lockfile, poisoning
	# every repo that calls them. A pre-commit hook cannot gate a bot; this can.
	name: Actions Lockfile Gate

	# NO `paths:` FILTER, deliberately. This check is meant to be REQUIRED, and a
	# required check whose workflow is skipped by path filtering never reports:
	# the PR sits on "Expected -- waiting for status" forever. Every PR that does
	# not touch .github/** would be permanently unmergeable. The job is a
	# checkout plus a few seconds of bash, so it runs on everything.
	on:
	pull_request:
	push:
	branches: [main]
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	lockfile-coverage:
	name: uses ⊆ actions.lock
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: "Every SHA-pinned uses: must be in the lockfile"
	run: bash .githooks/validate-actions-lock.sh

Navigation Menu