Pin GitHub Actions with a workflow lockfile

.github/workflows/actions-lock.yml

@@ -0,0 +1,54 @@
+# Checks that .github/workflows/actions.lock pins every action the workflows
+# use, directly or through other actions, to a commit that still verifies
+# upstream. GitHub runs the locked commits, so a tag that's moved since can't
+# change what runs. See
+# https://docs.github.com/en/actions/concepts/security/workflow-dependency-lockfiles
+#
+# After changing a workflow's `uses:`, update the lockfile with
+#   gh extension install github/gh-actions-lock
+#   gh actions-lock
+# and commit it with the change. If this check fails, its log ends with the
+# patch that does that, which is also kept as the actions-lock-fix artifact.
+name: actions-lock
+
+on:
+  push:
+    branches:
+      - main
+  # Into any branch, so that stacked pull requests are checked too.
+  pull_request:
+  # Catches a locked tag that's been moved upstream.
+  schedule:
+    - cron: '41 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify actions.lock
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v5.1.0
+        with:
+          persist-credentials: false
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify
+        run: gh actions-lock --verify
+      - name: Show the fix
+        if: failure()
+        run: |
+          gh actions-lock || true
+          git add --intent-to-add .github/workflows/actions.lock || true
+          git diff > actions-lock-fix.patch
+          cat actions-lock-fix.patch
+      - name: Keep the fix
+        if: failure()
+        uses: actions/upload-artifact@v5.0.0
+        with:
+          name: actions-lock-fix
+          path: actions-lock-fix.patch
+          if-no-files-found: ignore

.github/workflows/actions.lock

@@ -0,0 +1,53 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actions-lock.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/upload-artifact@v5.0.0'
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/upload-artifact@v5.0.0'
+        - 'astral-sh/setup-uv@v10.2.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/download-artifact@v5.0.0'
+        - 'actions/upload-artifact@v5.0.0'
+        - 'ruby/setup-ruby@v1.338.0'
+    '.github/workflows/screenshots.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/upload-artifact@v5.0.0'
+    '.github/workflows/testflight.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/upload-artifact@v5.0.0'
+        - 'ruby/setup-ruby@v1.338.0'
+    '.github/workflows/translations.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'astral-sh/setup-uv@v10.2.0'
+dependencies:
+    'actions/checkout@v5.1.0':
+        ref: 'v5.1.0'
+        commit: 'sha1-fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-634f93cb2916e3fdff6788551b99b062d0335ce0'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-330a01c490aca151604b8cf639adc76d48f6c5d4'
+        owner_id: 44036562
+        repo_id: 192625955
+    'astral-sh/setup-uv@v10.2.0':
+        ref: 'v10.2.0'
+        commit: 'sha1-c18668ad3cf93ea998bef934396af7bb5c839dc7'
+        owner_id: 115962839
+        repo_id: 846733598
+    'ruby/setup-ruby@v1.338.0':
+        ref: 'v1.338.0'
+        commit: 'sha1-b3aaceaef7e0ee231b499e7b5f49c03fc1d32199'
+        owner_id: 210414
+        repo_id: 231208785

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       # defaults to 27.0.
       DEVELOPER_DIR: /Applications/Xcode_27.1.app/Contents/Developer
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
       - name: Show Xcode
         run: xcodebuild -version
       - name: Test ClementineKit
@@ -32,7 +32,7 @@ jobs:
     name: Python
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
       - uses: astral-sh/setup-uv@v10.2.0
       - name: ruff check
         run: uv run ruff check --output-format github
@@ -51,7 +51,7 @@ jobs:
       # defaults to 27.0.
       DEVELOPER_DIR: /Applications/Xcode_27.1.app/Contents/Developer
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
       - name: Install XcodeGen
         run: brew install xcodegen
       - name: Check the Xcode project matches project.yml
@@ -107,7 +107,7 @@ jobs:
             echo "::error::App/Resources/Localizable.xcstrings is out of date. Run scripts/build.sh and commit the catalog it updated, or take it from this run's String Catalog artifact."
             exit 1
           fi
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v5.0.0
         if: failure()
         with:
           name: String Catalog

.github/workflows/release.yml

@@ -45,7 +45,7 @@ jobs:
       commit: ${{ steps.plan.outputs.commit }}
       first: ${{ steps.plan.outputs.first }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         with:
           # All of main's history and tags: the notes and version come from them.
           fetch-depth: 0
@@ -72,7 +72,7 @@ jobs:
             echo "::notice::Nothing has changed since the last release, so there's nothing to release."
           fi
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v5.0.0
         if: steps.plan.outputs.release == 'true'
         with:
           name: release-notes
@@ -117,7 +117,7 @@ jobs:
       FASTLANE_OPT_OUT_USAGE: "1"
       FASTLANE_HIDE_CHANGELOG: "1"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         with:
           ref: ${{ needs.plan.outputs.commit }}
 
@@ -135,14 +135,14 @@ jobs:
       - name: Build
         run: scripts/archive.sh "$NAME" "$BUILD" build/release
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v5.0.0
         with:
           name: release
           path: |
             build/release/ClementineRemote.ipa
             build/release/ClementineRemote.xcarchive/dSYMs/
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.338.0
         with:
           ruby-version: "3.4"
           bundler-cache: true
@@ -176,7 +176,7 @@ jobs:
       FASTLANE_OPT_OUT_USAGE: "1"
       FASTLANE_HIDE_CHANGELOG: "1"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         with:
           ref: ${{ needs.plan.outputs.commit }}
 
@@ -188,12 +188,12 @@ jobs:
           printf '%s\n' "$ASC_PRIVATE_KEY" > "$key"
           echo "ASC_KEY_PATH=$key" >> "$GITHUB_ENV"
 
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v5.0.0
         with:
           name: release-notes
           path: ${{ runner.temp }}/notes
 
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v5.0.0
         with:
           pattern: store-screenshots-*
           path: ${{ runner.temp }}/store-screenshots
@@ -216,7 +216,7 @@ jobs:
           done
           ls -l "$out"
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.338.0
         with:
           ruby-version: "3.4"
           bundler-cache: true

.github/workflows/screenshots.yml

@@ -96,7 +96,7 @@ jobs:
       # A step's condition can't read secrets, so this says whether the R2 token is set.
       HAS_R2_TOKEN: ${{ secrets.R2_ACCESS_KEY_ID != '' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         with:
           ref: ${{ inputs.ref }}
 
@@ -243,7 +243,7 @@ jobs:
           done
           exit $status
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v5.0.0
         if: always()
         with:
           name: ${{ inputs.artifact || 'screenshots' }}

.github/workflows/testflight.yml

@@ -52,7 +52,7 @@ jobs:
       # A step's condition can't read secrets, so this says whether the API key is set.
       HAS_ASC_KEY: ${{ secrets.ASC_KEY_ID != '' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         with:
           # The build number comes from the number of commits, and the version from the tags.
           fetch-depth: 0
@@ -92,15 +92,15 @@ jobs:
           TESTING_FEATURES: "YES"
         run: scripts/archive.sh "${{ steps.version.outputs.name }}" "${{ steps.version.outputs.build }}" build/release
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v5.0.0
         if: env.HAS_ASC_KEY == 'true'
         with:
           name: testflight
           path: |
             build/release/ClementineRemote.ipa
             build/release/ClementineRemote.xcarchive/dSYMs/
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.338.0
         if: env.HAS_ASC_KEY == 'true'
         with:
           ruby-version: "3.4"

.github/workflows/translations.yml

@@ -47,7 +47,7 @@ jobs:
     env:
       TX_TOKEN: ${{ secrets.TX_TOKEN }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
       - uses: astral-sh/setup-uv@v10.2.0
         if: env.TX_TOKEN != ''
       - name: Pull the translations made since the last pull
@@ -80,7 +80,7 @@ jobs:
         run: echo "::notice::The TX_TOKEN or TX_KEY secret isn't set, so no translations were pulled. See RELEASING.md."
       # Checked out with the deploy key, so the push below runs the other workflows on the new
       # commit (ci.yml, testflight.yml), as a push with the workflow's own token wouldn't.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.1.0
         if: env.TX_TOKEN != '' && env.HAS_TX_KEY == 'true'
         with:
           ref: main