rgarcia · Nov 13, 2026 · Nov 13, 2026 · Nov 14, 2026
diff --git a/.github/tests/fix-ci-security.test.mjs b/.github/tests/fix-ci-security.test.mjs
@@ -11,6 +11,24 @@ const jobs = Object.fromEntries(
     .slice(1)
     .map((job) => [job.slice(0, job.indexOf(':')), job.split(/(?=^      - )/m)]),
 );
+const lock = { workflows: {}, dependencies: {} };
+{
+  let section;
+  let key;
+  for (const line of readFileSync(new URL('../workflows/actions.lock', import.meta.url), 'utf8').split('\n')) {
+    let match;
+    if ((match = line.match(/^(\w+):/))) {
+      section = match[1];
+    } else if ((match = line.match(/^    '([^']+)':/)) && section in lock) {
+      key = match[1];
+      lock[section][key] = section === 'workflows' ? [] : {};
+    } else if (section === 'workflows' && (match = line.match(/^        - '([^']+)'$/))) {
+      lock.workflows[key].push(match[1]);
+    } else if (section === 'dependencies' && (match = line.match(/^        (\w+): '?([^']*)'?$/))) {
+      lock.dependencies[key][match[1]] = match[2];
+    }
+  }
+}
 const header = (job) => jobs[job][0];
 const steps = (job) => jobs[job].slice(1);
 const step = (job, name) => {
@@ -42,8 +60,23 @@ test('only failed runs of same-repository PRs are handled', () => {
 });
 
 test('actions are pinned and checkouts do not persist credentials', () => {
+  const locked = lock.workflows['.github/workflows/fix-ci.yaml'];
+  assert.ok(locked, 'fix-ci.yaml is not onboarded in actions.lock');
   for (const entry of Object.keys(jobs).flatMap(steps).filter((entry) => entry.includes('uses: '))) {
-    assert.match(entry, /uses: [\w./-]+@[a-f0-9]{40}(?:\s|$)/);
+    const uses = entry.match(/uses: (\S+)/)[1];
+    if (uses.startsWith('$/')) continue;
+    const match = uses.match(/^([\w.-]+\/[\w.-]+)(?:\/[\w./-]+)?@(\S+)$/);
+    assert.ok(match, `unexpected action reference: ${uses}`);
+    const [, repo, ref] = match;
+    const dependency = lock.dependencies[`${repo}@${ref}`];
+    assert.ok(locked.includes(`${repo}@${ref}`) && dependency, `${uses} is not locked in actions.lock`);
+    if (/^[a-f0-9]{40}$/.test(ref)) {
+      assert.equal(dependency.commit, `sha1-${ref}`);
+      assert.doesNotMatch(dependency.ref, /^v\d+\.\d+\.\d+$/, `${uses} is a tagged release; use @${dependency.ref}`);
+    } else {
+      assert.match(ref, /^v\d+\.\d+\.\d+$/, `${uses} must use an exact vX.Y.Z release`);
+      assert.equal(dependency.ref, ref);
+    }
     if (entry.includes('uses: actions/checkout@')) {
       assert.match(entry, /persist-credentials: false/);
       assert.doesNotMatch(entry, /token:/);

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
@@ -0,0 +1,73 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/breakglass.yml': []
+    '.github/workflows/fix-ci-security.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-node@v6.5.0'
+    '.github/workflows/fix-ci.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/setup-node@v6.5.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+    '.github/workflows/preview.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/release.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/setup-go@v6.5.0'
+        - 'actions/setup-node@v6.5.0'
+        - 'goreleaser/goreleaser-action@v7.3.0'
+    '.github/workflows/semgrep.yml': []
+    '.github/workflows/test.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/setup-go@v6.5.0'
+    '.github/workflows/vuln-remediation.yml': []
+dependencies:
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/setup-go@v6.5.0':
+        ref: 'v6.5.0'
+        commit: 'sha1-924ae3a1cded613372ab5595356fb5720e22ba16'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-node@v6.5.0':
+        ref: 'v6.5.0'
+        commit: 'sha1-249970729cb0ef3589644e2896645e5dc5ba9c38'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'goreleaser/goreleaser-action@v7.3.0':
+        ref: 'v7.3.0'
+        commit: 'sha1-a4f02ab5355a589de60d917a659ce617ed19b3de'
+        owner_id: 24697112
+        repo_id: 209873006
+    'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550':
+        ref: 'main'
+        commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
+        owner_id: 194616459
+        repo_id: 1207196574
diff --git a/.github/workflows/fix-ci-security.yaml b/.github/workflows/fix-ci-security.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@v6.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      - uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
       - run: node --test .github/tests/fix-ci-security.test.mjs
diff --git a/.github/workflows/fix-ci.yaml b/.github/workflows/fix-ci.yaml
@@ -33,7 +33,7 @@ jobs:
       FIX_BRANCH: ci-fix/${{ github.event.workflow_run.head_branch }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: |
@@ -62,7 +62,7 @@ jobs:
 
       - name: Check out pull request
         if: steps.pr.outputs.number != ''
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -80,7 +80,7 @@ jobs:
 
       - name: Setup Go
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: pr/go.mod
           # PR and agent code runs in this job, so it must not save caches that
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Node
         if: steps.pr.outputs.number != ''
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@v6.5.0
         with:
           node-version: '22'
 
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload validated fix
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: fix-ci
           path: |
@@ -206,20 +206,20 @@ jobs:
       FIX_SHA: ${{ needs.generate.outputs.fix_sha }}
     steps:
       - name: Check out workflow files
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           path: trusted
           sparse-checkout: .github/scripts
           persist-credentials: false
 
       - name: Download validated fix
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: fix-ci
           path: ${{ runner.temp }}/fix-ci
 
       - name: Check out pull request
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@v6.1.0
         with:
           ref: ${{ env.HEAD_SHA }}
           path: pr
@@ -247,7 +247,7 @@ jobs:
 
       - name: Generate publishing token
         id: publish-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        uses: actions/create-github-app-token@v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml
@@ -13,19 +13,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v6.5.0
         with:
           go-version-file: go.mod
           cache: true
       - name: Download dependencies
         run: go mod download
       - name: Build preview archives
         run: bash scripts/build-preview.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4.6.2
         with:
           name: kernel-preview-${{ github.event.pull_request.head.sha || github.sha }}
           path: dist/preview/*

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -15,25 +15,25 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@v3.3.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
           repositories: cli,homebrew-tap
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: "go.mod"
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.5.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
@@ -45,7 +45,7 @@ jobs:
         run: make clean-templates
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v7.3.0
         with:
           distribution: goreleaser-pro
           version: '~> v2'

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: "go.mod"
           cache: true