fix(ci): adopt Actions dependency lockfile (estate startup_failure remediation)

[hyperpolymath]

Estate sweep: this repo's every workflow has been startup_failure under GitHub's workflow-lockfile enforcement. Applies the template proven on haec (#46/#48) and echidna (#341): actions.lock, SPDX-first header order, hand-added entries for tool-skipped workflows, standards reusables re-pinned past the standards lockfile boundary (5a597720), illegal timeout-minutes stripped from reusable jobs, lockfile-aware SHA-pin lint.

The PR's own check runs are the test: executing checks (even failures) = enforcement satisfied.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

💡 Security: SHA pins replaced with mutable version tags across all workflows

Every workflow is changed from immutable commit pins (e.g. actions/checkout@3d3c42e…) to mutable version tags (actions/checkout@v7.0.1). GitHub Actions does not enforce actions.lock at runtime, so a moved/compromised tag would be pulled despite the lockfile, weakening supply-chain integrity and lowering this repo's own OSSF Scorecard Pinned-Dependencies score (it runs scorecard.yml). This also silently bundles major-version upgrades (codeql v3->v4, download-artifact v4->v8, action-gh-release v2->v3, repository-dispatch v3->v4) whose breaking changes are untested here. If mutable tags are truly required by the enforcement policy, ensure the lockfile is authoritative and CI actually verifies resolved commits; otherwise keep inline SHA pins.

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

⚠️ This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Adopts the Actions dependency lockfile and updates workflow headers to remediate startup failures. Consider addressing the minor finding where SHA pins were replaced with mutable version tags across workflows.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

💡 Security: SHA pins replaced with mutable version tags across all workflows

📄 .github/workflows/pages.yml:22-25 📄 .github/workflows/pages.yml:54-55

Every workflow is changed from immutable commit pins (e.g. actions/checkout@3d3c42e…) to mutable version tags (actions/checkout@v7.0.1). GitHub Actions does not enforce actions.lock at runtime, so a moved/compromised tag would be pulled despite the lockfile, weakening supply-chain integrity and lowering this repo's own OSSF Scorecard Pinned-Dependencies score (it runs scorecard.yml). This also silently bundles major-version upgrades (codeql v3->v4, download-artifact v4->v8, action-gh-release v2->v3, repository-dispatch v3->v4) whose breaking changes are untested here. If mutable tags are truly required by the enforcement policy, ensure the lockfile is authoritative and CI actually verifies resolved commits; otherwise keep inline SHA pins.

🤖 Prompt for agents

Code Review: Adopts the Actions dependency lockfile and updates workflow headers to remediate startup failures. Consider addressing the minor finding where SHA pins were replaced with mutable version tags across workflows.

1. 💡 Security: SHA pins replaced with mutable version tags across all workflows
   Files: .github/workflows/pages.yml:22-25, .github/workflows/pages.yml:54-55

   Every workflow is changed from immutable commit pins (e.g. `actions/checkout@3d3c42e…`) to mutable version tags (`actions/checkout@v7.0.1`). GitHub Actions does not enforce `actions.lock` at runtime, so a moved/compromised tag would be pulled despite the lockfile, weakening supply-chain integrity and lowering this repo's own OSSF Scorecard Pinned-Dependencies score (it runs scorecard.yml). This also silently bundles major-version upgrades (codeql v3->v4, download-artifact v4->v8, action-gh-release v2->v3, repository-dispatch v3->v4) whose breaking changes are untested here. If mutable tags are truly required by the enforcement policy, ensure the lockfile is authoritative and CI actually verifies resolved commits; otherwise keep inline SHA pins.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}