chore(ci): SPDX headers on line 1 and Actions lockfile minted

.github/workflows/actions.lock

@@ -0,0 +1,145 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/affine-vscode-publish.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/casket-pages.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/configure-pages@v6.0.0'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'haskell-actions/setup@v2.11.0'
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/coq-proof-gate.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/governance-baseline-impl.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/governance.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/instant-sync.yml':
+        - 'peter-evans/repository-dispatch@v4.0.1'
+    '.github/workflows/pages.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/upload-pages-artifact@v5.0.0'
+    '.github/workflows/panic-attack.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'dtolnay/rust-toolchain@master'
+    '.github/workflows/publish-jsr.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'denoland/setup-deno@v2.0.5'
+    '.github/workflows/push-email-notify.yml':
+        - 'dawidd6/action-send-mail@v3.12.0'
+    '.github/workflows/release.yml':
+        - 'actions/attest-build-provenance@v4.1.1'
+        - 'actions/checkout@v7.0.1'
+        - 'ocaml/setup-ocaml@v3.7.0'
+    '.github/workflows/secret-scanner.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/semgrep.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.4'
+    '.github/workflows/stdlib-naming.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/workflow-linter.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/attest-build-provenance@v4.1.1':
+        ref: 'v4.1.1'
+        commit: 'sha1-0f67c3f4856b2e3261c31976d6725780e5e4c373'
+        owner_id: 44036562
+        repo_id: 760702757
+        uses:
+            - 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763'
+    'actions/attest@a1948c3f048ba23858d222213b7c278aabede763':
+        ref: 'v4.1.1'
+        commit: 'sha1-a1948c3f048ba23858d222213b7c278aabede763'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/configure-pages@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-45bfe0192ca1faeb007ade9deae92b16b8254a0d'
+        owner_id: 44036562
+        repo_id: 513659658
+    'actions/deploy-pages@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/setup-node@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-820762786026740c76f36085b0efc47a31fe5020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'dawidd6/action-send-mail@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-2e600f3776677e493bf0da7aaec39a586d19a5ed'
+        owner_id: 9713907
+        repo_id: 222439721
+    'denoland/setup-deno@v2.0.5':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-2c7215f132e9ebf062739d9130488b56d53c060c'
+        owner_id: 1940490
+        repo_id: 260749683
+    'github/codeql-action@v4.37.4':
+        ref: 'v4.37.4'
+        commit: 'sha1-f205ea1c3313d32999d8d6a48b4f6530d4437b38'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@v2.11.0':
+        ref: 'v2.11.0'
+        commit: 'sha1-cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553'
+        owner_id: 75048950
+        repo_id: 623796603
+    'ocaml/setup-ocaml@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-15d660006c1d3110d77c34b7faa3bddefe8b82f0'
+        owner_id: 1841483
+        repo_id: 220799100
+    'peter-evans/repository-dispatch@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
+        owner_id: 18365890
+        repo_id: 220359305

.github/workflows/affine-vscode-publish.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Publishes @hyperpolymath/affine-vscode to npm on a scoped tag push.
 #
 # This repo is Deno-first (see CLAUDE.md). The npm publish here is a
@@ -33,7 +34,7 @@
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Verify tag matches package version
         working-directory: packages/affine-vscode
         run: |

.github/workflows/casket-pages.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 on:
   push:
@@ -49,19 +50,19 @@
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Checkout casket-ssg
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
       - name: Setup GHCup
-        uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2
+        uses: haskell-actions/setup@v2.11.0
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
       - name: Cache Cabal
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -102,7 +103,7 @@
           fi
           cd .casket-ssg && cabal run casket-ssg -- build ../site ../_site
       - name: Setup Pages
-        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        uses: actions/configure-pages@v6.0.0
         with:
           # Self-provision Pages on first run instead of failing with
           # 404 ("Get Pages site failed"). The repo had Pages disabled
@@ -113,7 +114,7 @@
           # this.
           enablement: true
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: '_site'
   deploy:
@@ -127,4 +128,4 @@
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@v5.0.0

.github/workflows/ci.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # Standalone CI: no dependency on third-party actions or external-repo
 # reusable workflows. The OCaml toolchain is self-hosted via apt + opam
@@ -34,7 +35,7 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           # Full history so the soundness-ledger gate (property 4) can resolve
           # :ground-truth-sha: and diff soundness paths against it. A shallow
@@ -51,7 +52,7 @@
             || opam switch create . ocaml-base-compiler.4.14.2 --no-install --yes
           opam exec -- ocaml -version
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: "20"
       - name: Install dependencies
@@ -117,7 +118,7 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
         run: |
           sudo apt-get update
@@ -146,7 +147,7 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
         run: |
           sudo apt-get update
@@ -182,7 +183,7 @@
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload bench log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: bench-output
           path: bench-output.log
@@ -196,7 +197,7 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml)
         run: |
           sudo apt-get update
@@ -231,7 +232,7 @@
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload coverage HTML
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: coverage-html
           path: _coverage
@@ -256,9 +257,9 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: "20"
       - name: Install test runner dependencies
@@ -301,9 +302,9 @@
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: "20"
       - name: Install tree-sitter CLI

.github/workflows/codeql.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 on:
   push:
@@ -35,13 +36,13 @@
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/coq-proof-gate.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Coq/Rocq proof gate for the `formal/` mechanised-metatheory track (issue #513).
 #
 # This gate is deliberately FAIL-CLOSED. It does NOT probe for the prover and
@@ -42,7 +43,7 @@
       image: coqorg/coq@sha256:e50d77c4c5a9aa0d76ae1b343d79c5f922da3a75054b79c5dc635895438e4674
       options: --user root
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
       # The coqorg images install Coq into an opam switch owned by the `coq`
       # user and put it on PATH via an ENTRYPOINT wrapper. GitHub Actions

.github/workflows/governance-baseline-impl.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # Local reusable backing `governance-baseline.yml`. Its single job is named
 # "Validate Hypatia baseline" so that, when called from a job with id
@@ -25,7 +26,7 @@
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
       - name: Validate .hypatia-baseline.json (if present)
         run: |
           set -euo pipefail

.github/workflows/governance-baseline.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # Required-check bridge: re-emits the estate-standard governance check context
 # `governance / Validate Hypatia baseline` on EVERY pull request.

.github/workflows/governance.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # Standalone governance gate. Previously a thin caller of
 # `hyperpolymath/standards/.github/workflows/governance-reusable.yml@main`;
@@ -26,7 +27,7 @@
     timeout-minutes: 5
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Fetch base ref (DOC-FORMAT delta)

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
 # See standards#191 for the reusable's purpose and design.