ci: verify the actions lockfile in CI

Fails the build when .github/workflows/actions.lock stops matching the workflows, or when a locked pin no longer verifies upstream, so a stale or tampered lockfile cannot go unnoticed between dependency updates.
ci: lock workflow actions through an actions.lock lockfile
2026-11-12 17:03:12 -06:00 · 2026-11-12 07:23:26 -05:00 · 2026-11-12 07:18:33 -05:00
7 changed files with 131 additions and 71 deletions
@@ -0,0 +1,57 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml': []
+    '.github/workflows/freebsd.yml': []
+    '.github/workflows/house-rules.yml': []
+    '.github/workflows/lockfile.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/nix.yml': []
+    '.github/workflows/packaging-lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.4'
+    '.github/workflows/printing.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'step-security/dtolnay-rust-toolchain@v1.0.0'
+        - 'step-security/harden-runner@v2.22.4'
+        - 'step-security/rust-cache@v2.9.2'
+        - 'storytold/craft-common-actions@main'
+    '.github/workflows/release.yml': []
+    '.github/workflows/sonarcloud.yml': []
+    '.github/workflows/windows-arm64.yml': []
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'step-security/dtolnay-rust-toolchain@v1.0.0':
+        ref: 'v1.0.0'
+        commit: 'sha1-8dd607977d06adf4ed49b190381e74c17a9dd25f'
+        owner_id: 88700172
+        repo_id: 1249865941
+    'step-security/harden-runner@v2.22.4':
+        ref: 'v2.22.4'
+        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
+        owner_id: 88700172
+        repo_id: 422287306
+    'step-security/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-8871c8ba063416da7c32246932ea6ae08700453e'
+        owner_id: 88700172
+        repo_id: 822636713
+    'storytold/craft-common-actions@main':
+        ref: 'main'
+        commit: 'sha1-293de72429d3ed5d9fa92aded5e500544c0fa28f'
+        owner_id: 76897702
+        repo_id: 1414429108
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
@@ -0,0 +1,34 @@
+name: Lockfile
+
+# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
+# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
+# Docs: https://gh.io/actions-lockfile
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  lockfile:
+    name: Lockfile is in sync
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.4
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-actions-lock
+        run: gh extension install github/gh-actions-lock --pin v0.4.1
+      - name: Verify the lockfile
+        run: gh actions-lock --verify
@@ -28,10 +28,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        uses: step-security/harden-runner@v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - name: Install the pinned packaging toolchain
@@ -43,10 +43,10 @@ jobs:
      CARGO_INCREMENTAL: '0'
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
+        uses: step-security/harden-runner@v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false

@@ -81,13 +81,13 @@ jobs:
            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers

-      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
+      - uses: step-security/dtolnay-rust-toolchain@v1.0.0
        with:
          toolchain: stable
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown

-      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
+      - uses: step-security/rust-cache@v2.9.2
        with:
          save-if: ${{ github.ref == 'refs/heads/main' }}

@@ -2338,23 +2338,23 @@ dependencies = [
 "foldhash 0.2.0",
 ]

+[[package]]
+name = "hayro-ccitt"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
+
 [[package]]
 name = "hayro-ccitt"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2866f0d976e76497480b853d5e258dab6e4b89ecfe991124e08f15dfa8fd03ad"

-[[package]]
-name = "hayro-ccitt"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adbed896e99325bc312778bb9c9c289d795d51c12775c44dd5e4352f679c7e46"
-
 [[package]]
 name = "hayro-cmap"
-version = "0.1.1"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a14afde3344be69225fec4f6f44f6a219a3a492f9d8301eb25ef608fe4b7014c"
+checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
 dependencies = [
 "brotli",
 "hayro-postscript",
@@ -2362,19 +2362,19 @@ dependencies = [

 [[package]]
 name = "hayro-interpret"
-version = "0.8.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac9df074ff163a63864cec9b0bf640ccbff8abf4e44481df7369ce0ac172ffbe"
+checksum = "f2613d0406898995042d0794c4245b2f2fba1246490c8ac593769bba6551129d"
 dependencies = [
 "bitflags 2.13.2",
 "hayro-cmap",
- "hayro-syntax 0.8.0",
+ "hayro-syntax",
 "kurbo",
 "moxcms",
 "phf 0.13.1",
 "rustc-hash 2.1.3",
 "siphasher",
- "skrifa 0.46.2",
+ "skrifa 0.42.1",
 "smallvec",
 "yoke",
 ]
@@ -2389,66 +2389,37 @@ dependencies = [
 "hayro-ccitt 0.4.0",
 ]

-[[package]]
-name = "hayro-jbig2"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb5c7f3a4eb551c2bb7fa16e268f728d4bc2a5c9b090554b8dc0ee2503fb5840"
-dependencies = [
- "hayro-ccitt 0.5.0",
-]
-
 [[package]]
 name = "hayro-jpeg2000"
-version = "0.4.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "122c5f834c37a2260b9c851bb8be685cf539b2a8b94b704a931ef7d2525d5835"
+checksum = "c75ab947623ef4ccaa7acf0579edf7cbb5a73838e3839a7be73335e522f433a1"
 dependencies = [
- "fearless_simd 1.1.0",
+ "fearless_simd 0.4.1",
 ]

-[[package]]
-name = "hayro-jpeg2000"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e5e5f2b3de970707fc22fd956d8f44211602939d5e4588603afa919cb7b3740"
-
 [[package]]
 name = "hayro-postscript"
-version = "0.2.0"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc2d80da85f31c3fdc0366431f44cfd645a9da1e242ed1f4a61f213d9765660f"
+checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"

 [[package]]
 name = "hayro-syntax"
-version = "0.8.0"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cdc818d8d265dcb42081d488f7599df4f73fb79e9d347ecedcd3c23809d2026"
+checksum = "0edeafd70aa2db743de8ede8637d07ec87db05efe69cde371d03f1b185fcef27"
 dependencies = [
 "flate2",
- "hayro-ccitt 0.4.0",
- "hayro-jbig2 0.3.1",
- "hayro-jpeg2000 0.4.1",
+ "hayro-ccitt 0.3.0",
+ "hayro-jbig2",
+ "hayro-jpeg2000",
 "memchr",
 "rustc-hash 2.1.3",
 "smallvec",
 "zune-jpeg",
 ]

-[[package]]
-name = "hayro-syntax"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ced8279487b029813f6cc05399099fa34df6fa23d8f7b0d41d972c49d5b30d"
-dependencies = [
- "hayro-ccitt 0.5.0",
- "hayro-jbig2 0.4.0",
- "hayro-jpeg2000 0.5.0",
- "rustc-hash 2.1.3",
- "smallvec",
- "zune-jpeg",
-]
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -5144,16 +5115,6 @@ dependencies = [
 "read-fonts 0.41.0",
 ]

-[[package]]
-name = "skrifa"
-version = "0.46.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4febebda507fb889c545a37a135517769d1391941013561292897961d1887d6"
-dependencies = [
- "bytemuck",
- "read-fonts 0.43.3",
-]
-
 [[package]]
 name = "skrifa"
 version = "0.47.0"
@@ -7091,7 +7052,7 @@ dependencies = [
 "craft-pdf",
 "hayro-cmap",
 "hayro-interpret",
- "hayro-syntax 0.9.0",
+ "hayro-syntax",
 "image",
 "js-sys",
 "kurbo",
@@ -26,6 +26,6 @@ chrono = { workspace = true }
 js-sys = "0.3"

 [dev-dependencies]
-hayro-syntax = "0.9.0"
-hayro-interpret = { version = "0.8.0", default-features = false, features = ["embed-fonts"] }
+hayro-syntax = "0.7.2"
+hayro-interpret = { version = "0.7.0", default-features = false, features = ["embed-fonts"] }
 hayro-cmap = "0.1"
@@ -4,6 +4,14 @@ sonar.organization=storytold
 # S4790 (weak hash): SHA-1 is a start-key and "SHA1/1K" checksum algorithm that ODF package
 # encryption (ODF 1.3 Part 2 §4.16) names, and older office suites wrote it. It is needed to open
 # those files, not chosen for new security: WordCraft writes a SHA-256 start key and checksum.
-sonar.issue.ignore.multicriteria=odt_sha1
+sonar.issue.ignore.multicriteria=odt_sha1,gha-lockfile
 sonar.issue.ignore.multicriteria.odt_sha1.ruleKey=rust:S4790
 sonar.issue.ignore.multicriteria.odt_sha1.resourceKey=crates/formats/src/odt/crypt.rs
+
+# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
+# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
+# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
+# the rule flags the tag refs anyway:
+# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
+sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
+sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**