From f019417ad8b8f8aafc78bfba754fa0c8e4e564d4 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:09:43 +0000
Subject: [PATCH] Lock workflow action dependencies with actions.lock

---
 .github/workflows/actions.lock    | 24 ++++++++++++++++++++++++
 .github/workflows/ci.yml          |  4 ++--
 .github/workflows/publish-mcp.yml |  2 +-
 3 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000..78d89547
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,24 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/breakglass.yml': []
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'oven-sh/setup-bun@v2.2.0'
+    '.github/workflows/publish-mcp.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/semgrep.yml': []
+    '.github/workflows/vuln-remediation.yml': []
+dependencies:
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'oven-sh/setup-bun@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6cae4bf3..35c92981 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,12 +19,12 @@ jobs:
           --health-timeout 3s
           --health-retries 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
 
       # Pin Bun: the managed-auth App bundle check is byte-exact and Bun's
       # minifier output can change between releases. Regenerate the bundle
       # with this exact version when bumping it.
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: "1.3.3"
 
diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml
index 26b71892..b737db7f 100644
--- a/.github/workflows/publish-mcp.yml
+++ b/.github/workflows/publish-mcp.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
 
       - name: Check whether this version is already published
         id: version