cameri / nostream / 43684132058

78%

push

github

ci: lock the actions on main too (#1117) (#1142)

Resolves #1117

### Description
PR #1116 added workflow lockfiles on `rewrite/main`
(`.github/workflows/actions.lock` plus a `lockfile` job running `gh
actions-lock --verify`).

`main` was not locked, and cannot inherit the lock from `rewrite/main`
by merging because `checks.yml` has no `rust-checks` and
`deploy-website.yml` differs.

This PR:
- Narrows mutable tags across all workflows on `main` to exact semantic
versions.
- Pinned `amannn/action-semantic-pull-request` to `v5.5.3`.
- Adds the `actions.lock` file generated with `gh actions-lock`
(v0.4.1).
- Adds the `lockfile` verification job in `checks.yml`.
- Adds an empty-frontmatter changeset (`.changeset/actions-lockfile.md`)
per repository convention.

### Verification
- `gh actions-lock --verify`: Validated all 7 workflows (`All 7
workflows valid`).
- Unit tests & CLI tests passing (`pnpm run test:unit`, `pnpm run
test:cli`).
- Changeset validation passing (`pnpm exec changeset status --since
origin/main`).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Chores**
* Updated the versions of tools used in release, deployment, and pull
request workflows.
  * Added a workflow check to verify recorded action versions.
* The changes affect workflow maintenance and do not alter application
behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

4905 of 6918 branches covered (70.9%)

Branch coverage included in aggregate %.

10681 of 13158 relevant lines covered (81.17%)

706.62 hits per line