From 30aac6de56796d08e6ca35f4db233ccbb966bc76 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:11:06 +0000
Subject: [PATCH 1/3] Lock workflow action dependencies with actions.lock

---
 .github/workflows/actions.lock            | 97 +++++++++++++++++++++++
 .github/workflows/ci.yml                  | 18 ++---
 .github/workflows/publish-npm.yml         |  4 +-
 .github/workflows/release-doctor.yml      |  2 +-
 .github/workflows/release-please.yml      |  6 +-
 .github/workflows/stlc-promote.yml        |  4 +-
 .github/workflows/stlc-sync.yml           |  2 +-
 .github/workflows/update-docs.yml         | 36 ++++-----
 .github/workflows/update-mcp-coverage.yml | 34 ++++----
 9 files changed, 150 insertions(+), 53 deletions(-)
 create mode 100644 .github/workflows/actions.lock

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000..07940b23
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,97 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/checkout@v6.0.2'
+        - 'actions/github-script@v8.0.0'
+        - 'actions/setup-node@v4.4.0'
+    '.github/workflows/publish-npm.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'actions/setup-node@v3.9.1'
+    '.github/workflows/release-doctor.yml':
+        - 'actions/checkout@v6.0.2'
+    '.github/workflows/release-please.yml':
+        - 'actions/create-github-app-token@v1.12.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/semgrep.yml': []
+    '.github/workflows/stlc-promote.yml':
+        - 'actions/checkout@v6.0.2'
+        - 'actions/create-github-app-token@v1.12.0'
+    '.github/workflows/stlc-sync.yml':
+        - 'actions/checkout@v6.0.2'
+    '.github/workflows/update-docs.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/create-github-app-token@v1.12.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+    '.github/workflows/update-mcp-coverage.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/create-github-app-token@v1.12.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+        - 'oven-sh/setup-bun@v2.2.0'
+    '.github/workflows/vuln-remediation.yml': []
+dependencies:
+    'actions/checkout@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v6.0.2':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v1.12.0':
+        ref: 'v1.12.0'
+        commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@v8.0.0':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-node@v3.9.1':
+        ref: 'v3.9.1'
+        commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-node@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550':
+        ref: 'main'
+        commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
+        owner_id: 194616459
+        repo_id: 1207196574
+    'oven-sh/setup-bun@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
+    'pnpm/action-setup@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
+        owner_id: 21320719
+        repo_id: 262289747
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3ee9bb15..f8d9a8d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: '24'
 
@@ -43,10 +43,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: '24'
 
@@ -61,7 +61,7 @@ jobs:
           github.repository == 'stainless-sdks/kernel-typescript' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -80,10 +80,10 @@ jobs:
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: '24'
 
@@ -99,8 +99,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/checkout@v4.3.1
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '22'
       - run: node --test .github/tests/update-coverage-security.test.mjs
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index d01da10b..d9c397f0 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -17,10 +17,10 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
+        uses: actions/setup-node@v3.9.1
         with:
           node-version: '24'
 
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index 4fef92eb..77478861 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'kernel/kernel-node-sdk' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6.0.2
 
       - name: Check release environment
         run: |
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e69a7175..0cc340f4 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Mint release token
         id: release-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -36,12 +36,12 @@ jobs:
           permission-workflows: write
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: '22'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        uses: pnpm/action-setup@v4.3.0
         with:
           version: '9.11.0'
           run_install: false
diff --git a/.github/workflows/stlc-promote.yml b/.github/workflows/stlc-promote.yml
index 9f2110e5..f54214a5 100644
--- a/.github/workflows/stlc-promote.yml
+++ b/.github/workflows/stlc-promote.yml
@@ -21,14 +21,14 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Check out staging
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Mint production token
         id: production-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/stlc-sync.yml b/.github/workflows/stlc-sync.yml
index 501a7084..de896dd6 100644
--- a/.github/workflows/stlc-sync.yml
+++ b/.github/workflows/stlc-sync.yml
@@ -27,7 +27,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Check out staging
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/update-docs.yml b/.github/workflows/update-docs.yml
index 4b795147..8746bfe4 100644
--- a/.github/workflows/update-docs.yml
+++ b/.github/workflows/update-docs.yml
@@ -30,7 +30,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       sha: ${{ steps.version.outputs.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4.3.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -69,13 +69,13 @@ jobs:
       UPDATE_BRANCH: sdk-docs-update
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           sparse-checkout: .github
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout docs
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -177,7 +177,7 @@ jobs:
       - name: Generate API read token
         if: steps.prepare.outputs.update == 'true'
         id: api-read-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -241,7 +241,7 @@ jobs:
       - name: Upload update context
         id: upload-context
         if: steps.prepare.outputs.update == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: sdk-docs-context
           path: ${{ runner.temp }}/context.tar.gz.cms
@@ -274,12 +274,12 @@ jobs:
       AGENT_BASE_TREE: ${{ needs.context.outputs.agent_base_tree }}
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -287,7 +287,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout Python SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/kernel-python-sdk
           path: python-sdk
@@ -295,7 +295,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout Go SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/kernel-go-sdk
           path: go-sdk
@@ -312,12 +312,12 @@ jobs:
             fi
           done
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '22'
 
       - name: Checkout docs
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -325,7 +325,7 @@ jobs:
           persist-credentials: false
 
       - name: Download update context
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: sdk-docs-context
           path: ${{ runner.temp }}
@@ -431,7 +431,7 @@ jobs:
 
       - name: Upload validated changes
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: sdk-docs-update
           path: |
@@ -454,18 +454,18 @@ jobs:
       UPDATE_BRANCH: sdk-docs-update
     steps:
       - name: Checkout updater scripts
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           persist-credentials: false
 
       - name: Download validated changes
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: sdk-docs-update
           path: ${{ runner.temp }}/sdk-docs-update
 
       - name: Checkout docs
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -503,7 +503,7 @@ jobs:
 
       - name: Generate docs repository token
         id: app-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/update-mcp-coverage.yml b/.github/workflows/update-mcp-coverage.yml
index c28dba9e..1a1aa7fe 100644
--- a/.github/workflows/update-mcp-coverage.yml
+++ b/.github/workflows/update-mcp-coverage.yml
@@ -25,7 +25,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       sha: ${{ steps.version.outputs.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@v4.3.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -72,13 +72,13 @@ jobs:
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           sparse-checkout: .github
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -86,7 +86,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout MCP server
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -149,7 +149,7 @@ jobs:
       - name: Generate API read token
         if: steps.prepare.outputs.update == 'true'
         id: api-read-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -210,7 +210,7 @@ jobs:
       - name: Upload update context
         id: upload-context
         if: steps.prepare.outputs.update == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: mcp-coverage-context
           path: ${{ runner.temp }}/context.tar.gz.cms
@@ -253,28 +253,28 @@ jobs:
           --health-retries 20
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '22'
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: '1.3.3'
 
       - name: Checkout MCP server
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -282,7 +282,7 @@ jobs:
           persist-credentials: false
 
       - name: Download update context
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: mcp-coverage-context
           path: ${{ runner.temp }}
@@ -393,7 +393,7 @@ jobs:
 
       - name: Upload validated changes
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: mcp-coverage-update
           path: |
@@ -416,18 +416,18 @@ jobs:
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater scripts
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           persist-credentials: false
 
       - name: Download validated changes
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@v4.3.0
         with:
           name: mcp-coverage-update
           path: ${{ runner.temp }}/mcp-coverage-update
 
       - name: Checkout MCP server
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -465,7 +465,7 @@ jobs:
 
       - name: Generate MCP repository token
         id: app-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+        uses: actions/create-github-app-token@v1.12.0
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

From 7136578870212a23e05d38345a944506f542f99d Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:15:54 +0000
Subject: [PATCH 2/3] Keep SHA pins where tests require them

---
 .github/workflows/actions.lock            | 66 +++++++++++++++++++++++
 .github/workflows/ci.yml                  | 18 +++----
 .github/workflows/publish-npm.yml         |  4 +-
 .github/workflows/release-doctor.yml      |  2 +-
 .github/workflows/stlc-promote.yml        |  4 +-
 .github/workflows/stlc-sync.yml           |  2 +-
 .github/workflows/update-docs.yml         | 36 ++++++-------
 .github/workflows/update-mcp-coverage.yml | 34 ++++++------
 8 files changed, 116 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 07940b23..71f1be79 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -4,14 +4,21 @@
 version: 'v0.0.3'
 workflows:
     '.github/workflows/ci.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         - 'actions/checkout@v4.3.1'
         - 'actions/checkout@v6.0.2'
+        - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
         - 'actions/github-script@v8.0.0'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
         - 'actions/setup-node@v4.4.0'
     '.github/workflows/publish-npm.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         - 'actions/checkout@v6.0.2'
+        - 'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610'
         - 'actions/setup-node@v3.9.1'
     '.github/workflows/release-doctor.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         - 'actions/checkout@v6.0.2'
     '.github/workflows/release-please.yml':
         - 'actions/create-github-app-token@v1.12.0'
@@ -19,27 +26,51 @@ workflows:
         - 'pnpm/action-setup@v4.3.0'
     '.github/workflows/semgrep.yml': []
     '.github/workflows/stlc-promote.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         - 'actions/checkout@v6.0.2'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
         - 'actions/create-github-app-token@v1.12.0'
     '.github/workflows/stlc-sync.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         - 'actions/checkout@v6.0.2'
     '.github/workflows/update-docs.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
         - 'actions/checkout@v4.3.1'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
         - 'actions/create-github-app-token@v1.12.0'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
         - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
         - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
         - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
     '.github/workflows/update-mcp-coverage.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
         - 'actions/checkout@v4.3.1'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
         - 'actions/create-github-app-token@v1.12.0'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
         - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
         - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
         - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
         - 'oven-sh/setup-bun@v2.2.0'
     '.github/workflows/vuln-remediation.yml': []
 dependencies:
+    'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/checkout@v4.3.1':
         ref: 'v4.3.1'
         commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
@@ -50,21 +81,46 @@ dependencies:
         commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547':
+        ref: 'v1.12.0'
+        commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
+        owner_id: 44036562
+        repo_id: 642580244
     'actions/create-github-app-token@v1.12.0':
         ref: 'v1.12.0'
         commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
         owner_id: 44036562
         repo_id: 642580244
+    'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/download-artifact@v4.3.0':
         ref: 'v4.3.0'
         commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
         owner_id: 44036562
         repo_id: 192626254
+    'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
     'actions/github-script@v8.0.0':
         ref: 'v8.0.0'
         commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
         owner_id: 44036562
         repo_id: 205262760
+    'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610':
+        ref: 'v3.9.1'
+        commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
     'actions/setup-node@v3.9.1':
         ref: 'v3.9.1'
         commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
@@ -75,6 +131,11 @@ dependencies:
         commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
         owner_id: 44036562
         repo_id: 189476904
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
     'actions/upload-artifact@v4.6.2':
         ref: 'v4.6.2'
         commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
@@ -85,6 +146,11 @@ dependencies:
         commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
         owner_id: 194616459
         repo_id: 1207196574
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
     'oven-sh/setup-bun@v2.2.0':
         ref: 'v2.2.0'
         commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8d9a8d8..3ee9bb15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
@@ -43,10 +43,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
@@ -61,7 +61,7 @@ jobs:
           github.repository == 'stainless-sdks/kernel-typescript' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -80,10 +80,10 @@ jobs:
     runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
@@ -99,8 +99,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4.3.1
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
       - run: node --test .github/tests/update-coverage-security.test.mjs
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index d9c397f0..d01da10b 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -17,10 +17,10 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v3.9.1
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '24'
 
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index 77478861..4fef92eb 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'kernel/kernel-node-sdk' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |
diff --git a/.github/workflows/stlc-promote.yml b/.github/workflows/stlc-promote.yml
index f54214a5..9f2110e5 100644
--- a/.github/workflows/stlc-promote.yml
+++ b/.github/workflows/stlc-promote.yml
@@ -21,14 +21,14 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Check out staging
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Mint production token
         id: production-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/stlc-sync.yml b/.github/workflows/stlc-sync.yml
index de896dd6..501a7084 100644
--- a/.github/workflows/stlc-sync.yml
+++ b/.github/workflows/stlc-sync.yml
@@ -27,7 +27,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Check out staging
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/update-docs.yml b/.github/workflows/update-docs.yml
index 8746bfe4..4b795147 100644
--- a/.github/workflows/update-docs.yml
+++ b/.github/workflows/update-docs.yml
@@ -30,7 +30,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       sha: ${{ steps.version.outputs.sha }}
     steps:
-      - uses: actions/checkout@v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -69,13 +69,13 @@ jobs:
       UPDATE_BRANCH: sdk-docs-update
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           sparse-checkout: .github
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout docs
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -177,7 +177,7 @@ jobs:
       - name: Generate API read token
         if: steps.prepare.outputs.update == 'true'
         id: api-read-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -241,7 +241,7 @@ jobs:
       - name: Upload update context
         id: upload-context
         if: steps.prepare.outputs.update == 'true'
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sdk-docs-context
           path: ${{ runner.temp }}/context.tar.gz.cms
@@ -274,12 +274,12 @@ jobs:
       AGENT_BASE_TREE: ${{ needs.context.outputs.agent_base_tree }}
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -287,7 +287,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout Python SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/kernel-python-sdk
           path: python-sdk
@@ -295,7 +295,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout Go SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/kernel-go-sdk
           path: go-sdk
@@ -312,12 +312,12 @@ jobs:
             fi
           done
 
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
 
       - name: Checkout docs
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -325,7 +325,7 @@ jobs:
           persist-credentials: false
 
       - name: Download update context
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: sdk-docs-context
           path: ${{ runner.temp }}
@@ -431,7 +431,7 @@ jobs:
 
       - name: Upload validated changes
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sdk-docs-update
           path: |
@@ -454,18 +454,18 @@ jobs:
       UPDATE_BRANCH: sdk-docs-update
     steps:
       - name: Checkout updater scripts
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
       - name: Download validated changes
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: sdk-docs-update
           path: ${{ runner.temp }}/sdk-docs-update
 
       - name: Checkout docs
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/docs
           path: docs
@@ -503,7 +503,7 @@ jobs:
 
       - name: Generate docs repository token
         id: app-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/update-mcp-coverage.yml b/.github/workflows/update-mcp-coverage.yml
index 1a1aa7fe..c28dba9e 100644
--- a/.github/workflows/update-mcp-coverage.yml
+++ b/.github/workflows/update-mcp-coverage.yml
@@ -25,7 +25,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       sha: ${{ steps.version.outputs.sha }}
     steps:
-      - uses: actions/checkout@v4.3.1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -72,13 +72,13 @@ jobs:
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           sparse-checkout: .github
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
@@ -86,7 +86,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout MCP server
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -149,7 +149,7 @@ jobs:
       - name: Generate API read token
         if: steps.prepare.outputs.update == 'true'
         id: api-read-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -210,7 +210,7 @@ jobs:
       - name: Upload update context
         id: upload-context
         if: steps.prepare.outputs.update == 'true'
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: mcp-coverage-context
           path: ${{ runner.temp }}/context.tar.gz.cms
@@ -253,28 +253,28 @@ jobs:
           --health-retries 20
     steps:
       - name: Checkout updater instructions
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
       - name: Checkout published SDK
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ env.SDK_SHA }}
           path: sdk
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
 
-      - uses: oven-sh/setup-bun@v2.2.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: '1.3.3'
 
       - name: Checkout MCP server
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -282,7 +282,7 @@ jobs:
           persist-credentials: false
 
       - name: Download update context
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: mcp-coverage-context
           path: ${{ runner.temp }}
@@ -393,7 +393,7 @@ jobs:
 
       - name: Upload validated changes
         if: steps.snapshot.outputs.changed == 'true'
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: mcp-coverage-update
           path: |
@@ -416,18 +416,18 @@ jobs:
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater scripts
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
       - name: Download validated changes
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: mcp-coverage-update
           path: ${{ runner.temp }}/mcp-coverage-update
 
       - name: Checkout MCP server
-        uses: actions/checkout@v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           repository: kernel/kernel-mcp-server
           path: mcp
@@ -465,7 +465,7 @@ jobs:
 
       - name: Generate MCP repository token
         id: app-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

From 34e9617e46dccf93e73835c662d25dca2d45cf7a Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 21:28:09 +0000
Subject: [PATCH 3/3] Generate actions.lock without rewriting generated uses:
 lines

---
 .github/workflows/actions.lock       | 74 ++--------------------------
 .github/workflows/release-please.yml |  6 +--
 2 files changed, 7 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 71f1be79..01bf3e59 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -6,59 +6,38 @@ workflows:
     '.github/workflows/ci.yml':
         - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
         - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        - 'actions/checkout@v4.3.1'
-        - 'actions/checkout@v6.0.2'
         - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
-        - 'actions/github-script@v8.0.0'
         - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
-        - 'actions/setup-node@v4.4.0'
     '.github/workflows/publish-npm.yml':
         - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        - 'actions/checkout@v6.0.2'
         - 'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610'
-        - 'actions/setup-node@v3.9.1'
     '.github/workflows/release-doctor.yml':
         - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        - 'actions/checkout@v6.0.2'
     '.github/workflows/release-please.yml':
-        - 'actions/create-github-app-token@v1.12.0'
-        - 'actions/setup-node@v4.4.0'
-        - 'pnpm/action-setup@v4.3.0'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'
     '.github/workflows/semgrep.yml': []
     '.github/workflows/stlc-promote.yml':
         - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        - 'actions/checkout@v6.0.2'
         - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
-        - 'actions/create-github-app-token@v1.12.0'
     '.github/workflows/stlc-sync.yml':
         - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        - 'actions/checkout@v6.0.2'
     '.github/workflows/update-docs.yml':
         - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
-        - 'actions/checkout@v4.3.1'
         - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
-        - 'actions/create-github-app-token@v1.12.0'
         - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
-        - 'actions/download-artifact@v4.3.0'
         - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
-        - 'actions/setup-node@v4.4.0'
         - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
-        - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
     '.github/workflows/update-mcp-coverage.yml':
         - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
-        - 'actions/checkout@v4.3.1'
         - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
-        - 'actions/create-github-app-token@v1.12.0'
         - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
-        - 'actions/download-artifact@v4.3.0'
         - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
-        - 'actions/setup-node@v4.4.0'
         - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
-        - 'actions/upload-artifact@v4.6.2'
         - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
         - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
-        - 'oven-sh/setup-bun@v2.2.0'
     '.github/workflows/vuln-remediation.yml': []
 dependencies:
     'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5':
@@ -71,46 +50,21 @@ dependencies:
         commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/checkout@v4.3.1':
-        ref: 'v4.3.1'
-        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
-        owner_id: 44036562
-        repo_id: 197814629
-    'actions/checkout@v6.0.2':
-        ref: 'v6.0.2'
-        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
-        owner_id: 44036562
-        repo_id: 197814629
     'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547':
         ref: 'v1.12.0'
         commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
         owner_id: 44036562
         repo_id: 642580244
-    'actions/create-github-app-token@v1.12.0':
-        ref: 'v1.12.0'
-        commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
-        owner_id: 44036562
-        repo_id: 642580244
     'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
         ref: 'v4.3.0'
         commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
         owner_id: 44036562
         repo_id: 192626254
-    'actions/download-artifact@v4.3.0':
-        ref: 'v4.3.0'
-        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
-        owner_id: 44036562
-        repo_id: 192626254
     'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
         ref: 'v8.0.0'
         commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
         owner_id: 44036562
         repo_id: 205262760
-    'actions/github-script@v8.0.0':
-        ref: 'v8.0.0'
-        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
-        owner_id: 44036562
-        repo_id: 205262760
     'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610':
         ref: 'v3.9.1'
         commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
@@ -121,26 +75,11 @@ dependencies:
         commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
         owner_id: 44036562
         repo_id: 189476904
-    'actions/setup-node@v3.9.1':
-        ref: 'v3.9.1'
-        commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
-        owner_id: 44036562
-        repo_id: 189476904
-    'actions/setup-node@v4.4.0':
-        ref: 'v4.4.0'
-        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
-        owner_id: 44036562
-        repo_id: 189476904
     'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
         ref: 'v4.6.2'
         commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v4.6.2':
-        ref: 'v4.6.2'
-        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
-        owner_id: 44036562
-        repo_id: 192625955
     'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550':
         ref: 'main'
         commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
@@ -151,12 +90,7 @@ dependencies:
         commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
         owner_id: 108928776
         repo_id: 512644635
-    'oven-sh/setup-bun@v2.2.0':
-        ref: 'v2.2.0'
-        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
-        owner_id: 108928776
-        repo_id: 512644635
-    'pnpm/action-setup@v4.3.0':
+    'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1':
         ref: 'v4.3.0'
         commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
         owner_id: 21320719
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 0cc340f4..b77e1e4a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Mint release token
         id: release-token
-        uses: actions/create-github-app-token@v1.12.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.ADMIN_APP_ID }}
           private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}
@@ -36,12 +36,12 @@ jobs:
           permission-workflows: write
 
       - name: Set up Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4.3.0
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: '9.11.0'
           run_install: false