[lpmi-13]

add in a github actions lockfile that asserts the actual owner of the referenced actions (just sha pinning doesn't do that and will resolve sha hashes from forks: https://www.vaines.org/posts/2026-03-24-the-comforting-lie-of-sha-pinning/).

https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/

[lpmi-13]

this is the documented way to refer to local actions:
https://github.com/github/gh-actions-lock#limitations

[Ickerday]

Yeah found out about this recently when running zizmor on some of our repos. The syntax does indeed work, but clankers desperately flag this as wrong despite noting down otherwise in AGENTS.md. We don't use LLMs here much, but non-maintainers will definitely bring this up thinking it's a mistake. Alas, we might need to leave this in for now just to spare ourselves the unnecessary busywork. :(

[lpmi-13]

Sure, whatever works for you! Just to confirm, do you mean the PR needs to be updated, or we need to hold off entirely?

[Ickerday]

Oooh didn't know about this yet, we'll have a look! <3