chore(ci): add GitHub Actions lockfile

.github/workflows/actions.lock

@@ -0,0 +1,93 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'voidzero-dev/setup-vp@v1.21.2'
+    '.github/workflows/ci.yml': []
+    '.github/workflows/lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'voidzero-dev/setup-vp@v1.21.2'
+    '.github/workflows/milestone.yml': []
+    '.github/workflows/publish.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/github-script@v9.0.0'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'voidzero-dev/setup-vp@v1.21.2'
+    '.github/workflows/release.yml':
+        - 'googleapis/release-please-action@v5.0.0'
+    '.github/workflows/renovate.yml': []
+    '.github/workflows/test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'sonarsource/sonarqube-scan-action@v8.3.0'
+        - 'voidzero-dev/setup-vp@v1.21.2'
+    '.github/workflows/triage.yml':
+        - 'amannn/action-semantic-pull-request@v6.1.1'
+        - 'fuxingloh/multi-labeler@v5.0.0'
+    '.github/workflows/website.yml': []
+    '.github/workflows/zizmor.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'zizmorcore/zizmor-action@v0.7.1'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'amannn/action-semantic-pull-request@v6.1.1':
+        ref: 'v6.1.1'
+        commit: 'sha1-48f256284bd46cdaab1048c3721360e808335d50'
+        owner_id: 4038316
+        repo_id: 220418983
+    'fuxingloh/multi-labeler@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-bcd50af464202999e57f556b4aefcf05a34abf85'
+        owner_id: 4266087
+        repo_id: 329257641
+    'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
+        owner_id: 9919
+        repo_id: 259445878
+    'googleapis/release-please-action@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7'
+        owner_id: 16785467
+        repo_id: 262236530
+    'sonarsource/sonarqube-scan-action@v8.3.0':
+        ref: 'v8.3.0'
+        commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
+        owner_id: 545988
+        repo_id: 366408409
+    'voidzero-dev/setup-vp@v1.21.2':
+        ref: 'v1.21.2'
+        commit: 'sha1-68f39c78aaf39be468cabd2afb09c162574c84af'
+        owner_id: 149750581
+        repo_id: 1133264797
+    'zizmorcore/zizmor-action@v0.7.1':
+        ref: 'v0.7.1'
+        commit: 'sha1-85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e'
+        owner_id: 210636713
+        repo_id: 985558803
+        uses:
+            - 'github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'

.github/workflows/build.yml

@@ -44,12 +44,12 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
 
@@ -68,7 +68,7 @@
         run: rm -rfv ${{ matrix.cleanup-path }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: ${{ matrix.artifact-name }}
           path: |

.github/workflows/lint.yml

@@ -14,12 +14,12 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
           node-version-file: '.nvmrc'
@@ -35,7 +35,7 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/

.github/workflows/publish.yml

@@ -62,12 +62,12 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
           node-version-file: '.nvmrc'
@@ -92,7 +92,7 @@
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: ${{ matrix.artifact-name }}
           path: |
@@ -201,13 +201,13 @@
           echo "Finalized milestone '${title}': ${url}"
 
       - name: Checkout trusted release automation
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
 
       - name: Notify pull requests included in the release
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/release.yml

@@ -25,7 +25,7 @@
     steps:
       - name: Run release-please (releases)
         id: release
-        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        uses: googleapis/release-please-action@v5.0.0
         with:
           skip-github-pull-request: true
 
@@ -41,7 +41,7 @@
       - name: Run release-please (release PR)
         id: pr
         if: ${{ steps.release.outputs.release_created != 'true' && steps.drafts.outputs.count == '0' }}
-        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        uses: googleapis/release-please-action@v5.0.0
         with:
           skip-github-release: true
 

.github/workflows/test.yml

@@ -17,12 +17,12 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
           node-version-file: '.nvmrc'
@@ -31,7 +31,7 @@
         run: vp run test
 
       - name: Archive code coverage results
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: code-coverage-report
           path: coverage/lcov.info
@@ -56,12 +56,12 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
           node-version-file: '.nvmrc'
@@ -77,7 +77,7 @@
       # __screenshots__. Download this to see what changed.
       - name: Archive visual diffs
         if: failure()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: visual-regression-diffs
           path: .vitest-attachments/
@@ -95,25 +95,25 @@
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@68f39c78aaf39be468cabd2afb09c162574c84af # v1.21.2
+        uses: voidzero-dev/setup-vp@v1.21.2
         with:
           cache: true
           node-version-file: '.nvmrc'
 
       - name: Download a single artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@v8.0.2
         with:
           name: code-coverage-report
           path: coverage/
 
       - name: SonarQube Cloud Scan
-        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        uses: SonarSource/sonarqube-scan-action@v8.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/triage.yml

@@ -47,7 +47,7 @@
     steps:
       - name: Validate semantic PR title
         if: ${{ github.event_name == 'pull_request_target' || startsWith(github.head_ref, 'release-please--') }}
-        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        uses: amannn/action-semantic-pull-request@v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -62,4 +62,4 @@
     steps:
       - name: Auto-label PR
         if: ${{ github.event_name == 'pull_request_target' || startsWith(github.head_ref, 'release-please--') }}
-        uses: fuxingloh/multi-labeler@bcd50af464202999e57f556b4aefcf05a34abf85 # v5.0.0
+        uses: fuxingloh/multi-labeler@v5.0.0

.github/workflows/zizmor.yml

@@ -20,9 +20,9 @@
       actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@v0.7.1