ci: verify the actions lockfile in CI

Fails the build when .github/workflows/actions.lock stops matching the workflows, or when a locked pin no longer verifies upstream, so a stale or tampered lockfile cannot go unnoticed between dependency updates.
ci: lock workflow actions through an actions.lock lockfile
2026-11-12 17:02:08 -06:00 · 2026-11-12 07:23:08 -05:00 · 2026-11-12 07:17:36 -05:00
6 changed files with 150 additions and 74 deletions
@@ -0,0 +1,29 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml': []
+    '.github/workflows/freebsd.yml': []
+    '.github/workflows/house-rules.yml': []
+    '.github/workflows/lockfile.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/nix.yml': []
+    '.github/workflows/packaging-lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/release.yml': []
+    '.github/workflows/sonarcloud.yml': []
+    '.github/workflows/windows-arm64.yml': []
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/harden-runner@v2.22.4':
+        ref: 'v2.22.4'
+        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
+        owner_id: 88700172
+        repo_id: 422287306
@@ -0,0 +1,34 @@
+name: Lockfile
+
+# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
+# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
+# Docs: https://gh.io/actions-lockfile
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  lockfile:
+    name: Lockfile is in sync
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.4
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify the lockfile
+        run: gh actions-lock --verify
@@ -28,10 +28,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        uses: step-security/harden-runner@v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - name: Install the pinned packaging toolchain
@@ -195,6 +195,15 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

+[[package]]
+name = "arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
+dependencies = [
+ "derive_arbitrary",
+]
+
 [[package]]
 name = "arboard"
 version = "3.7.0"
@@ -1012,7 +1021,7 @@ dependencies = [
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
 "objc2-foundation 0.3.2",
- "skrifa 0.44.0",
+ "skrifa",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -1042,7 +1051,7 @@ dependencies = [
 "verifysign",
 "winreg",
 "winsafe",
- "zip",
+ "zip 9.1.0",
 ]

 [[package]]
@@ -1113,7 +1122,7 @@ source = "git+https://github.com/storytold/craft-libs?rev=bb57d422d0bc842cbde430
 dependencies = [
 "flate2",
 "thiserror 2.0.21",
- "zip",
+ "zip 9.1.0",
 ]

 [[package]]
@@ -1241,6 +1250,17 @@ version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e9de72ce2ad1f90dc62fa25f0f430ef85eb4b0d8fa0be4f30373bc40a21d28e"

+[[package]]
+name = "derive_arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "dify"
 version = "0.8.0"
@@ -1372,7 +1392,7 @@ dependencies = [
 "objc2-foundation 0.3.2",
 "parking_lot",
 "percent-encoding",
- "pollster",
+ "pollster 1.0.1",
 "profiling",
 "raw-window-handle",
 "send_wrapper",
@@ -1487,7 +1507,7 @@ dependencies = [
 "kittest",
 "log",
 "open",
- "pollster",
+ "pollster 1.0.1",
 "serde",
 "tempfile",
 "toml",
@@ -1586,7 +1606,7 @@ dependencies = [
 "parking_lot",
 "profiling",
 "self_cell",
- "skrifa 0.44.0",
+ "skrifa",
 "smallvec",
 "unicode-bidi",
 "unicode-general-category",
@@ -1792,9 +1812,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

 [[package]]
 name = "font-types"
-version = "0.12.7"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "835ae9d781464a79026cde387f9cbc650c9a4909d7cf7e658b127e3c35d2f35d"
+checksum = "6c92d9081c7ab3bd83ef1eecdfad090f3d966e3ce74106779664114cfe1a6274"
 dependencies = [
 "bytemuck",
 ]
@@ -2007,7 +2027,7 @@ dependencies = [
 "hashbrown 0.17.1",
 "log",
 "peniko",
- "skrifa 0.44.0",
+ "skrifa",
 "smallvec",
 "vello_common",
 ]
@@ -2125,7 +2145,7 @@ dependencies = [
 "muda",
 "objc2 0.6.5",
 "objc2-app-kit 0.3.2",
- "pollster",
+ "pollster 1.0.1",
 "rfd",
 "serde_json",
 "winit",
@@ -2163,9 +2183,9 @@ dependencies = [
 "gridcraft-mcp",
 "gridcraft-sandbox",
 "log",
- "quick-xml 0.42.0",
+ "quick-xml 0.41.0",
 "serde_json",
- "zip",
+ "zip 3.0.0",
 ]

 [[package]]
@@ -2200,7 +2220,7 @@ dependencies = [
 "serde_json",
 "thiserror 2.0.21",
 "web-time",
- "zip",
+ "zip 3.0.0",
 ]

 [[package]]
@@ -2292,7 +2312,7 @@ dependencies = [
 "log",
 "serde",
 "serde_json",
- "skrifa 0.48.0",
+ "skrifa",
 "sys-locale",
 "toml",
 "unicode-bidi",
@@ -2334,10 +2354,10 @@ dependencies = [
 "gridcraft-functions",
 "gridcraft-math",
 "gridcraft-model",
- "quick-xml 0.42.0",
+ "quick-xml 0.41.0",
 "sha2 0.11.1",
 "thiserror 2.0.21",
- "zip",
+ "zip 3.0.0",
 ]

 [[package]]
@@ -2388,7 +2408,7 @@ checksum = "c03d949a14aa089bbb282f7dd76a498a7f684428e4257202efc119ec010376f9"
 dependencies = [
 "bitflags 2.13.2",
 "bytemuck",
- "read-fonts 0.41.0",
+ "read-fonts",
 "smallvec",
 ]

@@ -3002,9 +3022,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"

 [[package]]
 name = "libc"
-version = "0.2.191"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"

 [[package]]
 name = "libloading"
@@ -3078,9 +3098,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.35"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

 [[package]]
 name = "lru-slab"
@@ -3379,7 +3399,6 @@ dependencies = [
 "objc2-core-foundation",
 "objc2-core-graphics",
 "objc2-foundation 0.3.2",
- "objc2-uniform-type-identifiers 0.3.2",
 ]

 [[package]]
@@ -3598,7 +3617,7 @@ dependencies = [
 "objc2-link-presentation",
 "objc2-quartz-core 0.2.2",
 "objc2-symbols",
- "objc2-uniform-type-identifiers 0.2.2",
+ "objc2-uniform-type-identifiers",
 "objc2-user-notifications",
 ]

@@ -3625,16 +3644,6 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

-[[package]]
-name = "objc2-uniform-type-identifiers"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7902ac02859fc1f7045f8b598c63f1ae0cc7efeaa06a9bc9f3d9a3c955974fa4"
-dependencies = [
- "objc2 0.6.5",
- "objc2-foundation 0.3.2",
-]
-
 [[package]]
 name = "objc2-user-notifications"
 version = "0.2.2"
@@ -3961,6 +3970,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "pollster"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
+
 [[package]]
 name = "pollster"
 version = "1.0.1"
@@ -4229,9 +4244,9 @@ checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"

 [[package]]
 name = "ratex-font"
-version = "0.1.15"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4373503a1068c9f7d07862583bbd897ac4d2bdf89d42ac8c65870c33135bf6f"
+checksum = "6a7b73531dabe934a3e725ed5c90d18dacf43778b7a208381390943a9a8c24db"
 dependencies = [
 "phf 0.11.3",
 "ratex-types",
@@ -4280,9 +4295,9 @@ dependencies = [

 [[package]]
 name = "ratex-types"
-version = "0.1.15"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae81208192f9898cbd2424aa42fd4472bd79c44a52092673b101cdca72c89b7c"
+checksum = "0cf0be3d050525f0f7d37af55a443d7648c222ccc617639950e3de1f8e6f9900"
 dependencies = [
 "serde",
 ]
@@ -4336,19 +4351,6 @@ dependencies = [
 "once_cell",
 ]

-[[package]]
-name = "read-fonts"
-version = "0.45.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4edc8db0d972de88e53a085b1f01fb3fbdae7bb0cb7a0ce2b2f8285a412fe3ef"
-dependencies = [
- "bytemuck",
- "foldhash 0.2.0",
- "font-types",
- "once_cell",
- "yoke",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.4.1"
@@ -4462,9 +4464,9 @@ dependencies = [

 [[package]]
 name = "rfd"
-version = "0.18.0"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4b9d4857b10297ffb0f64cae711e983a7aeaee561848d56d429d3858bd8ed93"
+checksum = "20dafead71c16a34e1ff357ddefc8afc11e7d51d6d2b9fbd07eaa48e3e540220"
 dependencies = [
 "block2 0.6.2",
 "dispatch2",
@@ -4475,9 +4477,8 @@ dependencies = [
 "objc2-app-kit 0.3.2",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
- "objc2-uniform-type-identifiers 0.3.2",
 "percent-encoding",
- "pollster",
+ "pollster 0.4.0",
 "raw-window-handle",
 "wasm-bindgen",
 "wasm-bindgen-futures",
@@ -5098,17 +5099,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "819ab7d62b1d3e72d9d9dea5650bac30424f9111364bb94928dbf5ecad1baa68"
 dependencies = [
 "bytemuck",
- "read-fonts 0.41.0",
-]
-
-[[package]]
-name = "skrifa"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5213b4825bac3587046330052d61bfac7bd3bd0d203c758d7c2ef726fcea034"
-dependencies = [
- "bytemuck",
- "read-fonts 0.45.1",
+ "read-fonts",
 ]

 [[package]]
@@ -7078,6 +7069,20 @@ dependencies = [
 "syn 3.0.6",
 ]

+[[package]]
+name = "zip"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12598812502ed0105f607f941c386f43d441e00148fce9dec3ca5ffb0bde9308"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "zopfli",
+]
+
 [[package]]
 name = "zip"
 version = "9.1.0"
@@ -7092,7 +7097,6 @@ dependencies = [
 "nix",
 "typed-path",
 "windows-sys 0.61.2",
- "zopfli",
 ]

 [[package]]
@@ -52,8 +52,8 @@ chrono = { version = "0.4.45", default-features = false, features = ["std", "clo
 web-time = "1.1.0"
 rayon = "1"
 regex = { version = "1", default-features = false, features = ["std", "unicode", "perf"] }
-quick-xml = "0.42"
-zip = { version = "9", default-features = false, features = ["deflate"] }
+quick-xml = "0.41"
+zip = { version = "3", default-features = false, features = ["deflate"] }
 sha2 = { version = "0.11", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }

@@ -61,21 +61,21 @@ image = { version = "0.25", default-features = false, features = ["png", "jpeg"]
 # young (0.1.x), and the gate recorded in docs/decisions.md vetted this release.
 ratex-parser = "=0.1.14"
 ratex-layout = "=0.1.14"
-ratex-types = "=0.1.15"
-ratex-font = "=0.1.15"
+ratex-types = "=0.1.14"
+ratex-font = "=0.1.14"

 # ui
 egui = "0.37"
 egui_extras = { version = "0.37", default-features = false }
 eframe = { version = "0.37", default-features = false }
 egui_kittest = "0.37"
-rfd = "0.18"
+rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
 # The desktop's preferred language, for the first-run interface language (native only).
 sys-locale = "0.3"
 # Font parser egui's epaint uses; the UI validates system font files with it before handing them
 # to egui, which panics on a file it can't parse. Same version as epaint's, so no second copy.
-skrifa = { version = "0.48", default-features = false, features = ["std"] }
+skrifa = { version = "0.44", default-features = false, features = ["std"] }
 # Real font bytes for tests (Ubuntu Light, compiled into epaint).
 epaint_default_fonts = "0.37"
 # One native window per workbook: the window list, Window menu titles and the immediate-viewport
@@ -4,3 +4,12 @@ sonar.organization=storytold
 # The region table is one record per locale with the same field names and many shared values
 # (month names, formats); that repetition is data, not copy-pasted logic.
 sonar.cpd.exclusions=crates/core/src/region.rs
+
+# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
+# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
+# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
+# the rule flags the tag refs anyway:
+# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
+sonar.issue.ignore.multicriteria=gha-lockfile
+sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
+sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**