[setchy]

Summary

Adds a GitHub Actions lockfile generated with gh actions-lock, recording a verified commit SHA for every action used by the workflows (direct and transitive) in .github/workflows/actions.lock.

• Workflows reference readable version tags; the lockfile records the immutable SHA resolved for each ref.
• Existing inline SHA pins in the workflows were consolidated into the lockfile.

Notes

• Regenerate the lockfile after adding or changing any uses: with gh actions-lock.
• Verify it in CI with gh actions-lock --verify.

Some security scanners still expect inline SHA pins and may flag the tag refs until they understand workflow lockfiles. If preferred, the inline pins can be kept alongside the lockfile.

[netlify]

✅ Deploy Preview for atlassify canceled.

Name	Link
🔨 Latest commit	f59ba4e
🔍 Latest deploy log	https://app.netlify.com/projects/atlassify/deploys/6ae95b21f5e1d4a154894dd6

[github-advanced-security]

zizmor found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[gitar-bot]

CI failed: Actionlint fails across 11 workflow steps because local action references are written as `$/.github/actions/setup-node` with no ref, instead of `./.github/actions/setup-node`; this is a configuration error whose relationship to this PR is unclear.

Overview

One unique error template was found across 2 failing jobs (8 logs analyzed in total for the run). The failure is a single configuration error in workflow uses values, reported by actionlint and repeated across workflow files.

Failures

Malformed local action reference in workflow uses (confidence: high)

• Type: configuration
• Affected jobs: 125716434552, 125716434516
• Related to change: unclear
• Root cause: Actionlint reports .github/...:52:15: specifying action "$/.github/actions/setup-node" in invalid format because ref is missing. available formats are "{owner}/{repo}@{ref}" or "{owner}/{repo}/{path}@{ref}". The local action is written as $/.github/actions/setup-node in 11 uses: lines across workflow files (for example lines 25, 27, 31, 45, 49, 52, 56, 65, 66, 70, 98). The PR changes workflow files, but the available metadata does not show whether these references were introduced by this PR, so the relationship is unclear.
• Suggested fix: Replace every uses: $/.github/actions/setup-node occurrence with uses: ./.github/actions/setup-node in the affected workflow files, then rerun actionlint.

Summary

• Change-related failures: None confirmed. The single failure group is marked unclear, so it is not counted as change-related.
• Infrastructure/flaky failures: None identified.
• Recommended action: Fix the uses paths for the local setup-node action in all affected workflow files, then rerun the Actionlint job and confirm whether the malformed references came from this PR's changes.

Code Review ✅ Approved

🔴 High risk · Switching workflow action refs from immutable SHAs to movable tags, while recording SHAs separately, could let retagged actions run with CI credentials.

Adds a GitHub Actions lockfile (.github/workflows/actions.lock) generated with gh actions-lock, recording verified commit SHAs for every direct and transitive action used by the workflows. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}