From 0ea9146b5f1231fa13ee442ffbad2b50f128c0c1 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 20 Sep 2026 02:02:32 +0000
Subject: [PATCH] fix(ci): reconcile the workflows with actions.lock
 (gh-actions-lock v0.1.6)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`actions.lock` is authoritative: the workflows carry readable refs and the lock records the
commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable — `startup_failure`, "Invalid lockfile".

Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are
reverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.
---
 .github/workflows/security.yml |  6 +++---
 .github/workflows/verify.yml   | 14 +++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 75b8601..a1b145d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -30,13 +30,13 @@ jobs:
       matrix:
         language: [actions, python]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+      - uses: github/codeql-action/init@v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+      - uses: github/codeql-action/analyze@v4.36.2
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 470eda3..f18be88 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -32,11 +32,11 @@ jobs:
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git ripgrep python3 \
             agda-bin=2.6.4.3-1+b2 elixir=1.18.3.dfsg-1
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Checkout merged epistemic foundations
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@v6.0.3
         with:
           repository: hyperpolymath/epistemic-types
           ref: ad14e35e6e437b116284a43ecff5ebc09d67e37e
@@ -56,7 +56,7 @@ jobs:
           git -c safe.directory="$GITHUB_WORKSPACE" -C "$GITHUB_WORKSPACE" diff --exit-code -- proofs/agda/Firmboot/ElixirAgreement.agda
       - name: Retain exact verification diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: agda-elixir-verification
           path: .ci-results
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Install proof audit dependency
@@ -95,7 +95,7 @@ jobs:
           bash proofs/lean/verify.sh | tee .ci-results/lean/verify.log
       - name: Retain the complete Lean proof audit log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: lean-verification
           path: .ci-results/lean
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Install the authoritative lockfile verifier
@@ -128,7 +128,7 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git reuse=5.0.2-1
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Validate complete licence and copyright coverage