[rgarcia]

Adds GitHub's workflow dependency lockfile. .github/workflows/actions.lock records the commit behind every action the workflows use, so a moved tag on a third-party action can't change what runs in CI. That includes the release, promotion and CLI coverage workflows that use actions/create-github-app-token.

• .github/workflows/actions.lock was generated with gh actions-lock, not edited by hand. gh actions-lock --verify passes (7 workflows valid). It prints a notice that 7 actions are pinned to a bare SHA without a tag ref; those are the update-cli-coverage.yml pins described below.
• In ci.yml, release-please.yml, stlc-promote.yml and stlc-sync.yml, actions were SHA-pinned with a version comment. They are now written as their exact release tag, for example actions/checkout@v6.0.2 and actions/create-github-app-token@v1.12.0, with the commit recorded in the lockfile. The commits are unchanged. pnpm/action-setup in release-please.yml was pinned to the SHA of the annotated v4 tag object, which the lockfile rejects as a commit pin; it is now v4.3.0, the commit that tag points to.
• update-cli-coverage.yml is unchanged. .github/tests/update-coverage-security.test.mjs requires its actions to be pinned to full commit SHAs, so those pins stay as they are and the lockfile records them by SHA (generated with gh actions-lock --no-narrow).
• Only uses: lines change.
• Not covered: job-level reusable workflow calls to kernel/security-workflows/...@main (semgrep.yml, vuln-remediation.yml). A lockfile does not cover reusable workflows.

Stainless-generated workflows. Most workflow files here are maintained by the Stainless SDK generator, which has rewritten uses: lines before (for example, "ci: pin GitHub Actions to commit SHAs"). If a later codegen run changes an action ref, it has to be re-locked with gh actions-lock, otherwise the workflow will fail the lockfile check. These edits may also show up as custom code in the generator and could conflict on a future workflow template change.

[github-actions]

Semgrep: 28 findings detected

Too many findings to triage automatically (limit: 20).

Next steps:

1. Review the workflow run
2. Add // nosemgrep or .semgrepignore entries for accepted patterns
3. Fix genuine issues and re-push

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ab6dfb8. Configure here.}