[setchy]

Summary

Adds a GitHub Actions lockfile generated with gh actions-lock. Every action used by the workflows (direct and transitive) is recorded with its verified commit SHA in .github/workflows/actions.lock.

• Workflows reference readable version tags (e.g. actions/checkout@v7.0.1); the lockfile records the immutable SHA resolved for each ref.
• Existing inline SHA pins in the workflows were consolidated into the lockfile.

Notes

• Regenerate the lockfile after adding or changing any uses: with gh actions-lock.
• Verify it in CI with gh actions-lock --verify.

Rollout considerations

gh actions-lock stores pins in the lockfile, so workflows move back to version tags. The org's current tooling still enforces inline SHA pinning:

• Renovate (local>gitify-app/renovate-config → helpers:pinGitHubActionDigestsToSemver) will re-pin these refs on its next run.
• zizmor's unpinned-uses audit flags tag refs.
• SonarCloud rule githubactions:S7637 flags tag refs.

These tools do not understand lockfiles yet. Adopting this approach needs a policy decision: either relax those checks to ref-pin and rely on the lockfile, or keep inline SHA pins and use actions.lock as an additional record of transitive dependencies (gh actions-lock --verify accepts that state).

[github-advanced-security]

zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud