From 6fe41310803d6d38473a9788603755cbd2b2fc94 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:10:51 +0000
Subject: [PATCH 1/3] Lock workflow action dependencies with actions.lock

---
 .github/workflows/actions.lock         | 73 ++++++++++++++++++++++++++
 .github/workflows/fix-ci-security.yaml |  4 +-
 .github/workflows/fix-ci.yaml          | 18 +++----
 .github/workflows/preview.yaml         |  6 +--
 .github/workflows/release.yaml         | 10 ++--
 .github/workflows/test.yaml            |  4 +-
 6 files changed, 94 insertions(+), 21 deletions(-)
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000..36ed15a9
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,73 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/breakglass.yml': []
+    '.github/workflows/fix-ci-security.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-node@v6.5.0'
+    '.github/workflows/fix-ci.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/setup-node@v6.5.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+    '.github/workflows/preview.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/release.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/setup-node@v6.5.0'
+        - 'goreleaser/goreleaser-action@v7.3.0'
+    '.github/workflows/semgrep.yml': []
+    '.github/workflows/test.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-go@v6.5.0'
+    '.github/workflows/vuln-remediation.yml': []
+dependencies:
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-go@v6.5.0':
+        ref: 'v6.5.0'
+        commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-node@v6.5.0':
+        ref: 'v6.5.0'
+        commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'goreleaser/goreleaser-action@v7.3.0':
+        ref: 'v7.3.0'
+        commit: 'sha1-a4f02ab5355a589de60d917a659ce617ed19b3de'
+        owner_id: 24697112
+        repo_id: 209873006
+    'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550':
+        ref: 'main'
+        commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
+        owner_id: 194616459
+        repo_id: 1207196574
diff --git a/.github/workflows/fix-ci-security.yaml b/.github/workflows/fix-ci-security.yaml
index 907f4ea3..5a58470d 100644
--- a/.github/workflows/fix-ci-security.yaml
+++ b/.github/workflows/fix-ci-security.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
       - run: node --test .github/tests/fix-ci-security.test.mjs
diff --git a/.github/workflows/fix-ci.yaml b/.github/workflows/fix-ci.yaml
index 8790c74f..b23bebf7 100644
--- a/.github/workflows/fix-ci.yaml
+++ b/.github/workflows/fix-ci.yaml
@@ -33,7 +33,7 @@ jobs:
       FIX_BRANCH: ci-fix/${{ github.event.workflow_run.head_branch }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: |
@@ -62,7 +62,7 @@ jobs:
 
       - name: Check out pull request
         if: steps.pr.outputs.number != ''
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -80,7 +80,7 @@ jobs:
 
       - name: Setup Go
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: pr/go.mod
           # PR and agent code runs in this job, so it must not save caches that
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Node
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
 
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload validated fix
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: fix-ci
           path: |
@@ -206,20 +206,20 @@ jobs:
       FIX_SHA: ${{ needs.generate.outputs.fix_sha }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: .github/scripts
           persist-credentials: false
 
       - name: Download validated fix
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: fix-ci
           path: ${{ runner.temp }}/fix-ci
 
       - name: Check out pull request
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -247,7 +247,7 @@ jobs:
 
       - name: Generate publishing token
         id: publish-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        uses: actions/create-github-app-token@v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml
index fd952919..a74d69f2 100644
--- a/.github/workflows/preview.yaml
+++ b/.github/workflows/preview.yaml
@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -25,7 +25,7 @@ jobs:
         run: go mod download
       - name: Build preview archives
         run: bash scripts/build-preview.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4.6.2
         with:
           name: kernel-preview-${{ github.event.pull_request.head.sha || github.sha }}
           path: dist/preview/*
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f8baf9eb..d390e130 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,25 +15,25 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
           repositories: cli,homebrew-tap
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.5.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
@@ -45,7 +45,7 @@ jobs:
         run: make clean-templates
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v7.3.0
         with:
           distribution: goreleaser-pro
           version: '~> v2'
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 5f10d664..088215b6 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: "go.mod"
           cache: true

From 03ed2711fa3940c37eb6a0a539df3d487322cc1e Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:15:51 +0000
Subject: [PATCH 2/3] Keep SHA pins where tests require them

---
 .github/workflows/actions.lock         | 38 ++++++++++++++++++++++++++
 .github/workflows/fix-ci-security.yaml |  4 +--
 .github/workflows/fix-ci.yaml          | 18 ++++++------
 3 files changed, 49 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 36ed15a9..135637cc 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -5,14 +5,22 @@ version: 'v0.0.3'
 workflows:
     '.github/workflows/breakglass.yml': []
     '.github/workflows/fix-ci-security.yaml':
+        - 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'
         - 'actions/checkout@v6.1.0'
+        - 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38'
         - 'actions/setup-node@v6.5.0'
     '.github/workflows/fix-ci.yaml':
+        - 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'
         - 'actions/checkout@v6.1.0'
+        - 'actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
         - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
         - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16'
         - 'actions/setup-go@v6.5.0'
+        - 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38'
         - 'actions/setup-node@v6.5.0'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
         - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
     '.github/workflows/preview.yaml':
@@ -31,31 +39,61 @@ workflows:
         - 'actions/setup-go@v6.5.0'
     '.github/workflows/vuln-remediation.yml': []
 dependencies:
+    'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/checkout@v6.1.0':
         ref: 'v6.1.0'
         commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
     'actions/create-github-app-token@v3.3.0':
         ref: 'v3.3.0'
         commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
         owner_id: 44036562
         repo_id: 642580244
+    'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/download-artifact@v4.3.0':
         ref: 'v4.3.0'
         commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
         owner_id: 44036562
         repo_id: 192626254
+    'actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16':
+        ref: 'v6.5.0'
+        commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
+        owner_id: 44036562
+        repo_id: 192624594
     'actions/setup-go@v6.5.0':
         ref: 'v6.5.0'
         commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
         owner_id: 44036562
         repo_id: 192624594
+    'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38':
+        ref: 'v6.5.0'
+        commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
+        owner_id: 44036562
+        repo_id: 189476904
     'actions/setup-node@v6.5.0':
         ref: 'v6.5.0'
         commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
         owner_id: 44036562
         repo_id: 189476904
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-artifact@v4.6.2':
         ref: 'v4.6.2'
         commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
diff --git a/.github/workflows/fix-ci-security.yaml b/.github/workflows/fix-ci-security.yaml
index 5a58470d..907f4ea3 100644
--- a/.github/workflows/fix-ci-security.yaml
+++ b/.github/workflows/fix-ci-security.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6.1.0
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v6.5.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '22'
       - run: node --test .github/tests/fix-ci-security.test.mjs
diff --git a/.github/workflows/fix-ci.yaml b/.github/workflows/fix-ci.yaml
index b23bebf7..8790c74f 100644
--- a/.github/workflows/fix-ci.yaml
+++ b/.github/workflows/fix-ci.yaml
@@ -33,7 +33,7 @@ jobs:
       FIX_BRANCH: ci-fix/${{ github.event.workflow_run.head_branch }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@v6.1.0
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: trusted
           sparse-checkout: |
@@ -62,7 +62,7 @@ jobs:
 
       - name: Check out pull request
         if: steps.pr.outputs.number != ''
-        uses: actions/checkout@v6.1.0
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -80,7 +80,7 @@ jobs:
 
       - name: Setup Go
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-go@v6.5.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: pr/go.mod
           # PR and agent code runs in this job, so it must not save caches that
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Node
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-node@v6.5.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '22'
 
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload validated fix
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: fix-ci
           path: |
@@ -206,20 +206,20 @@ jobs:
       FIX_SHA: ${{ needs.generate.outputs.fix_sha }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@v6.1.0
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: trusted
           sparse-checkout: .github/scripts
           persist-credentials: false
 
       - name: Download validated fix
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: fix-ci
           path: ${{ runner.temp }}/fix-ci
 
       - name: Check out pull request
-        uses: actions/checkout@v6.1.0
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -247,7 +247,7 @@ jobs:
 
       - name: Generate publishing token
         id: publish-token
-        uses: actions/create-github-app-token@v3.3.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

From 7214e06ce7d2405309cb8512c594d4add3785083 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Sat, 14 Nov 2026 01:07:53 +0000
Subject: [PATCH 3/3] Narrow fix-ci workflows to release tags and check pins
 against actions.lock

---
 .github/tests/fix-ci-security.test.mjs | 35 +++++++++++++++++++++++-
 .github/workflows/actions.lock         | 38 --------------------------
 .github/workflows/fix-ci-security.yaml |  4 +--
 .github/workflows/fix-ci.yaml          | 18 ++++++------
 4 files changed, 45 insertions(+), 50 deletions(-)

diff --git a/.github/tests/fix-ci-security.test.mjs b/.github/tests/fix-ci-security.test.mjs
index f5fe05d9..93c2478c 100644
--- a/.github/tests/fix-ci-security.test.mjs
+++ b/.github/tests/fix-ci-security.test.mjs
@@ -11,6 +11,24 @@ const jobs = Object.fromEntries(
     .slice(1)
     .map((job) => [job.slice(0, job.indexOf(':')), job.split(/(?=^      - )/m)]),
 );
+const lock = { workflows: {}, dependencies: {} };
+{
+  let section;
+  let key;
+  for (const line of readFileSync(new URL('../workflows/actions.lock', import.meta.url), 'utf8').split('\n')) {
+    let match;
+    if ((match = line.match(/^(\w+):/))) {
+      section = match[1];
+    } else if ((match = line.match(/^    '([^']+)':/)) && section in lock) {
+      key = match[1];
+      lock[section][key] = section === 'workflows' ? [] : {};
+    } else if (section === 'workflows' && (match = line.match(/^        - '([^']+)'$/))) {
+      lock.workflows[key].push(match[1]);
+    } else if (section === 'dependencies' && (match = line.match(/^        (\w+): '?([^']*)'?$/))) {
+      lock.dependencies[key][match[1]] = match[2];
+    }
+  }
+}
 const header = (job) => jobs[job][0];
 const steps = (job) => jobs[job].slice(1);
 const step = (job, name) => {
@@ -42,8 +60,23 @@ test('only failed runs of same-repository PRs are handled', () => {
 });
 
 test('actions are pinned and checkouts do not persist credentials', () => {
+  const locked = lock.workflows['.github/workflows/fix-ci.yaml'];
+  assert.ok(locked, 'fix-ci.yaml is not onboarded in actions.lock');
   for (const entry of Object.keys(jobs).flatMap(steps).filter((entry) => entry.includes('uses: '))) {
-    assert.match(entry, /uses: [\w./-]+@[a-f0-9]{40}(?:\s|$)/);
+    const uses = entry.match(/uses: (\S+)/)[1];
+    if (uses.startsWith('$/')) continue;
+    const match = uses.match(/^([\w.-]+\/[\w.-]+)(?:\/[\w./-]+)?@(\S+)$/);
+    assert.ok(match, `unexpected action reference: ${uses}`);
+    const [, repo, ref] = match;
+    const dependency = lock.dependencies[`${repo}@${ref}`];
+    assert.ok(locked.includes(`${repo}@${ref}`) && dependency, `${uses} is not locked in actions.lock`);
+    if (/^[a-f0-9]{40}$/.test(ref)) {
+      assert.equal(dependency.commit, `sha1-${ref}`);
+      assert.doesNotMatch(dependency.ref, /^v\d+\.\d+\.\d+$/, `${uses} is a tagged release; use @${dependency.ref}`);
+    } else {
+      assert.match(ref, /^v\d+\.\d+\.\d+$/, `${uses} must use an exact vX.Y.Z release`);
+      assert.equal(dependency.ref, ref);
+    }
     if (entry.includes('uses: actions/checkout@')) {
       assert.match(entry, /persist-credentials: false/);
       assert.doesNotMatch(entry, /token:/);
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 135637cc..36ed15a9 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -5,22 +5,14 @@ version: 'v0.0.3'
 workflows:
     '.github/workflows/breakglass.yml': []
     '.github/workflows/fix-ci-security.yaml':
-        - 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'
         - 'actions/checkout@v6.1.0'
-        - 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38'
         - 'actions/setup-node@v6.5.0'
     '.github/workflows/fix-ci.yaml':
-        - 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'
         - 'actions/checkout@v6.1.0'
-        - 'actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
         - 'actions/create-github-app-token@v3.3.0'
-        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
         - 'actions/download-artifact@v4.3.0'
-        - 'actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16'
         - 'actions/setup-go@v6.5.0'
-        - 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38'
         - 'actions/setup-node@v6.5.0'
-        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
         - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
     '.github/workflows/preview.yaml':
@@ -39,61 +31,31 @@ workflows:
         - 'actions/setup-go@v6.5.0'
     '.github/workflows/vuln-remediation.yml': []
 dependencies:
-    'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803':
-        ref: 'v6.1.0'
-        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
-        owner_id: 44036562
-        repo_id: 197814629
     'actions/checkout@v6.1.0':
         ref: 'v6.1.0'
         commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510':
-        ref: 'v3.3.0'
-        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
-        owner_id: 44036562
-        repo_id: 642580244
     'actions/create-github-app-token@v3.3.0':
         ref: 'v3.3.0'
         commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
         owner_id: 44036562
         repo_id: 642580244
-    'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
-        ref: 'v4.3.0'
-        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
-        owner_id: 44036562
-        repo_id: 192626254
     'actions/download-artifact@v4.3.0':
         ref: 'v4.3.0'
         commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
         owner_id: 44036562
         repo_id: 192626254
-    'actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16':
-        ref: 'v6.5.0'
-        commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
-        owner_id: 44036562
-        repo_id: 192624594
     'actions/setup-go@v6.5.0':
         ref: 'v6.5.0'
         commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
         owner_id: 44036562
         repo_id: 192624594
-    'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38':
-        ref: 'v6.5.0'
-        commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
-        owner_id: 44036562
-        repo_id: 189476904
     'actions/setup-node@v6.5.0':
         ref: 'v6.5.0'
         commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
         owner_id: 44036562
         repo_id: 189476904
-    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
-        ref: 'v4.6.2'
-        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
-        owner_id: 44036562
-        repo_id: 192625955
     'actions/upload-artifact@v4.6.2':
         ref: 'v4.6.2'
         commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
diff --git a/.github/workflows/fix-ci-security.yaml b/.github/workflows/fix-ci-security.yaml
index 907f4ea3..5a58470d 100644
--- a/.github/workflows/fix-ci-security.yaml
+++ b/.github/workflows/fix-ci-security.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
       - run: node --test .github/tests/fix-ci-security.test.mjs
diff --git a/.github/workflows/fix-ci.yaml b/.github/workflows/fix-ci.yaml
index 8790c74f..b23bebf7 100644
--- a/.github/workflows/fix-ci.yaml
+++ b/.github/workflows/fix-ci.yaml
@@ -33,7 +33,7 @@ jobs:
       FIX_BRANCH: ci-fix/${{ github.event.workflow_run.head_branch }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: |
@@ -62,7 +62,7 @@ jobs:
 
       - name: Check out pull request
         if: steps.pr.outputs.number != ''
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -80,7 +80,7 @@ jobs:
 
       - name: Setup Go
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: pr/go.mod
           # PR and agent code runs in this job, so it must not save caches that
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Node
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
 
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload validated fix
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: fix-ci
           path: |
@@ -206,20 +206,20 @@ jobs:
       FIX_SHA: ${{ needs.generate.outputs.fix_sha }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: .github/scripts
           persist-credentials: false
 
       - name: Download validated fix
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: fix-ci
           path: ${{ runner.temp }}/fix-ci
 
       - name: Check out pull request
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -247,7 +247,7 @@ jobs:
 
       - name: Generate publishing token
         id: publish-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        uses: actions/create-github-app-token@v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}