[rgarcia]

Adds GitHub's workflow dependency lockfile. .github/workflows/actions.lock records the exact commit behind every action the workflows use, and the runner refuses to run an action whose resolved commit doesn't match. A moved or hijacked tag on a third-party action can no longer change what runs in CI.

• Added .github/workflows/actions.lock, generated with gh actions-lock (not hand-edited).
• Every uses: line is now an exact vX.Y.Z release, and the commit SHAs live in the lockfile. Floating refs in test.yaml, preview.yaml and release.yaml were narrowed (e.g. actions/checkout@v6 → v6.1.0, goreleaser/goreleaser-action@v7 → v7.3.0).
• fix-ci.yaml and fix-ci-security.yaml were SHA-pinned. They are now written as release tags, and each tag's locked commit is the SHA it replaces (also checked against the upstream tag):

Action	Old SHA pin	New ref	Locked commit	Same
actions/checkout	d23441a48e51	v6.1.0	d23441a48e51	yes
actions/create-github-app-token	64ab729a6294	v3.3.0	64ab729a6294	yes
actions/download-artifact	d3f86a106a0b	v4.3.0	d3f86a106a0b	yes
actions/setup-go	924ae3a1cded	v6.5.0	924ae3a1cded	yes
actions/setup-node	249970729cb0	v6.5.0	249970729cb0	yes
actions/upload-artifact	ea165f8d65b6	v4.6.2	ea165f8d65b6	yes

• kernel/security-workflows/.github/actions/llm-credentials stays pinned to its 40-char SHA because that commit has no release tag. It is recorded in the lockfile.
• .github/tests/fix-ci-security.test.mjs: the "actions are pinned" check used to require a 40-char SHA. It now requires each uses: in fix-ci.yaml to be an exact vX.Y.Z (a 40-char SHA only for commits without a release tag, or $/ for same-repo actions), and requires fix-ci.yaml to be onboarded in actions.lock with an entry for that exact ref. The persist-credentials/token check and every other test are unchanged.

Not covered: job-level reusable workflow calls (breakglass.yml, semgrep.yml, vuln-remediation.yml → kernel/security-workflows/...@main). The lockfile does not lock jobs.<id>.uses; those are unchanged.

• gh actions-lock --verify passes (all 8 workflows valid), and node --test .github/tests/fix-ci-security.test.mjs passes.
• To change an action version later: edit the uses: line, run gh actions-lock, and commit both files.

[github-actions]

Semgrep: 21 findings detected

Too many findings to triage automatically (limit: 20).

Next steps:

1. Review the workflow run
2. Add // nosemgrep or .semgrepignore entries for accepted patterns
3. Fix genuine issues and re-push

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6fe4131. Configure here.}

[github-actions]

Semgrep: 21 findings detected

Too many findings to triage automatically (limit: 20).

Next steps:

1. Review the workflow run
2. Add // nosemgrep or .semgrepignore entries for accepted patterns
3. Fix genuine issues and re-push