From 6888c3800a904b90629c5560a3cddec6babda4ea Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 12 Nov 2026 07:22:59 -0500
Subject: [PATCH] ci: verify the actions lockfile in CI

Fails the build when .github/workflows/actions.lock stops matching the
workflows, or when a locked pin no longer verifies upstream, so a stale or
tampered lockfile cannot go unnoticed between dependency updates.
---
 .github/workflows/actions.lock |  3 +++
 .github/workflows/lockfile.yml | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 .github/workflows/lockfile.yml

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 55e5d23fd..5e478baa9 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -8,6 +8,9 @@ workflows:
         - 'step-security/harden-runner@v2.22.4'
     '.github/workflows/freebsd.yml': []
     '.github/workflows/house-rules.yml': []
+    '.github/workflows/lockfile.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
     '.github/workflows/nix.yml': []
     '.github/workflows/packaging-lint.yml':
         - 'actions/checkout@v7.0.1'
diff --git a/.github/workflows/lockfile.yml b/.github/workflows/lockfile.yml
new file mode 100644
index 000000000..e630c9a8f
--- /dev/null
+++ b/.github/workflows/lockfile.yml
@@ -0,0 +1,34 @@
+name: Lockfile
+
+# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
+# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
+# Docs: https://gh.io/actions-lockfile
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  lockfile:
+    name: Lockfile is in sync
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.4
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify the lockfile
+        run: gh actions-lock --verify