actions.lock drift on main: dependabot bumps left 4 refs + codeql SHA unlocked (Actions lockfile verify red) #885

Finding

governance / Actions lockfile verify is red on main at 300fd45 (run 36729214094). Dependabot bumped uses: refs without refreshing .github/actions.lock:

The check is not required on main, so it does not block merges. It is inherited by every open PR, e.g. #884, which touches no workflow file.

Acceptance criteria

• .github/actions.lock pins exactly the refs the workflows use (the 4 ref-changed rows above), each with its resolved commit SHA (not a tag-object SHA).
• The codeql-action entries carry a symbolic ref next to the SHA, so no sha-as-ref findings remain.
• governance / Actions lockfile verify is green on a PR against main, and after merge on main itself.
• The lock is updated by hand-verified edit or verify-mode only. gh actions-lock rewrite mode is known to de-pin SHAs to tags and corrupt local action refs.
• Follow-up: dependabot's action bumps refresh the lock in the same PR (or a companion job does), so this drift cannot recur.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK