aboucaud · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026 · Nov 12, 2026
diff --git a/.github/renovate.json5 b/.github/renovate.json5
@@ -0,0 +1,34 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: ['config:recommended'],
+  // Actions only; Python and npm dependencies are updated by hand.
+  enabledManagers: ['github-actions', 'custom.regex'],
+  schedule: ['before 6am on monday'],
+  // Let a release age a week before proposing it: a compromised or
+  // broken release is usually caught and pulled within days.
+  minimumReleaseAge: '7 days',
+  packageRules: [
+    {
+      // Only `uses:` references. Runner labels and the versions passed to
+      // setup actions are choices: tests.yml's uv must stay the scaffold's
+      // floor, and its runner is pinned until #270.
+      matchManagers: ['github-actions'],
+      matchDepTypes: ['uses-with', 'github-runner'],
+      enabled: false,
+    },
+    {
+      matchManagers: ['github-actions', 'custom.regex'],
+      groupName: 'GitHub Actions',
+    },
+  ],
+  customManagers: [
+    {
+      // The gh-actions-lock extension lint.yml installs to verify the lock.
+      customType: 'regex',
+      managerFilePatterns: ['/^\\.github/workflows/.+\\.ya?ml$/'],
+      matchStrings: ['gh extension install github/gh-actions-lock --pin (?<currentValue>v\\S+)'],
+      depNameTemplate: 'github/gh-actions-lock',
+      datasourceTemplate: 'github-releases',
+    },
+  ],
+}
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
@@ -0,0 +1,107 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/claude-code-review.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'anthropics/claude-code-action@v1.0.268'
+    '.github/workflows/claude.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'anthropics/claude-code-action@v1.0.268'
+    '.github/workflows/dco.yml':
+        - 'actions/github-script@v8.0.0'
+    '.github/workflows/eval.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/github-script@v8.0.0'
+        - 'actions/upload-artifact@v6.0.0'
+        - 'astral-sh/setup-uv@v7.6.0'
+    '.github/workflows/lint.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'astral-sh/setup-uv@v7.6.0'
+    '.github/workflows/pypi-publish.yaml':
+        - 'actions/checkout@v6.0.2'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/setup-python@v6.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+        - 'astral-sh/setup-uv@v8.0.0'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+    '.github/workflows/tests.yml':
+        - 'actions/checkout@v5.1.0'
+        - 'actions/setup-node@v5.0.0'
+        - 'astral-sh/setup-uv@v7.6.0'
+dependencies:
+    'actions/checkout@v5.1.0':
+        ref: 'v5.1.0'
+        commit: 'sha1-fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v6.0.2':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@v8.0.0':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-node@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-a0853c24544627f65ddf259abe73b1d18a591444'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
+        ref: 'v6.2.0'
+        commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/setup-python@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-e797f83bcb11b83ae66e0230d6156d7c80228e7c'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@v6.0.0':
+        ref: 'v6.0.0'
+        commit: 'sha1-b7c566a772e6b6bfb58ed0dc250532a479d7789f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'anthropics/claude-code-action@v1.0.268':
+        ref: 'v1.0.268'
+        commit: 'sha1-c0949c50a78c1ec8ce2647db36629b870e715d0c'
+        owner_id: 76263028
+        repo_id: 986421638
+        uses:
+            - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+    'astral-sh/setup-uv@v7.6.0':
+        ref: 'v7.6.0'
+        commit: 'sha1-37802adc94f370d6bfd71619e3f0bf239e1f3b78'
+        owner_id: 115962839
+        repo_id: 846733598
+    'astral-sh/setup-uv@v8.0.0':
+        ref: 'v8.0.0'
+        commit: 'sha1-cec208311dfd045dd5311c1add060b2062131d57'
+        owner_id: 115962839
+        repo_id: 846733598
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
+    'pypa/gh-action-pypi-publish@v1.14.3':
+        ref: 'v1.14.3'
+        commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086'
+        owner_id: 647025
+        repo_id: 178055147
+        uses:
+            - 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
@@ -22,13 +22,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.1.0
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1.0.268
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -1,7 +1,7 @@
 name: Claude Code
 
 on:
-  issue_comment:
+  issue_comment:  # zizmor: ignore[dangerous-triggers] read-only token; the action checks write access
     types: [created]
   pull_request_review_comment:
     types: [created]
@@ -26,13 +26,14 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5.1.0
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1.0.268
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
@@ -1,11 +1,11 @@
 name: DCO
 
 on:
-  pull_request_target:
+  pull_request_target:  # zizmor: ignore[dangerous-triggers] no checkout, no interpolation
     types: [opened, reopened, synchronize]
   pull_request_review:
     types: [submitted]
-  issue_comment:
+  issue_comment:  # zizmor: ignore[dangerous-triggers] same
     types: [created]
 
 permissions:
@@ -23,7 +23,7 @@ jobs:
        (contains(github.event.comment.body, 'I have read the Developer Certificate of Origin') ||
         github.event.comment.body == 'recheck'))
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8.0.0
         with:
           script: |
             const SIGN_OFF_TEXT = 'I have read the Developer Certificate of Origin and I hereby sign the DCO for this PR';

diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
@@ -30,19 +30,20 @@ jobs:
     # report/comment/artifact steps along with it.
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5.1.0
         with:
           # Full history so hatch-vcs sees the tags and stamps a truthful
           # dev version into the installed engine (and every manifest's
           # lc_version) instead of a 0.1.dev fallback
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up uv
         # No python-version input: it would export an ambient UV_PYTHON,
         # which lc's install-settings scrub then rightly warns about on
         # every single invocation the agent makes. The interpreter is
         # pinned per tool install below instead.
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7.6.0
         with:
           enable-cache: true
 
@@ -182,7 +183,7 @@ jobs:
 
       - name: Comment on PR
         if: always() && github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8.0.0
         with:
           script: |
             const fs = require('fs');
@@ -212,7 +213,7 @@ jobs:
 
       - name: Upload agent trace
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6.0.0
         with:
           name: agent-trace
           path: |
@@ -223,7 +224,7 @@ jobs:
 
       - name: Upload eval project
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6.0.0
         with:
           name: eval-project
           # include-hidden-files keeps the manifests, the run records in

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -9,16 +9,21 @@ on:
     # marked ready never runs at all until someone happens to push again.
     types: [opened, synchronize, reopened, ready_for_review]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     if: github.event_name == 'push' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7.6.0
         with:
           python-version: "3.13"
           enable-cache: true
@@ -32,3 +37,23 @@ jobs:
 
       - name: Mypy
         run: mypy src/
+
+  lockfile:
+    # Fails when actions.lock is out of sync with the workflows, or a
+    # locked commit no longer verifies upstream. After any `uses:` edit,
+    # regenerate it with `gh actions-lock`.
+    if: github.event_name == 'push' || github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - uses: actions/checkout@v5.1.0
+        with:
+          persist-credentials: false
+
+      # Pinned; bumped by Renovate's custom regex manager in
+      # .github/renovate.json5, so keep this line's shape.
+      - run: gh extension install github/gh-actions-lock --pin v0.4.1
+
+      - run: gh actions-lock --verify
diff --git a/.github/workflows/pypi-publish.yaml b/.github/workflows/pypi-publish.yaml
@@ -35,7 +35,9 @@ jobs:
         uses: astral-sh/setup-uv@v8.0.0
         with:
           python-version: ${{ matrix.pyversion }}
-          enable-cache: true
+          # A release builds from nothing: a restored cache is whatever
+          # an earlier run on main left in it.
+          enable-cache: false
 
       # https://github.com/actions/setup-python
       - name: Set up Python
@@ -72,6 +74,6 @@ jobs:
 
       # https://github.com/pypa/gh-action-pypi-publish
       - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           verbose: true
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -9,6 +9,9 @@ on:
     # marked ready never runs at all until someone happens to push again.
     types: [opened, synchronize, reopened, ready_for_review]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: github.event_name == 'push' || github.event.pull_request.draft == false
@@ -18,7 +21,10 @@ jobs:
       # OS is exactly the information the other run is there to provide.
       fail-fast: false
       matrix:
-        os: [ubuntu-latest]
+        # Pinned until #270: ubuntu-latest is now 26.04, whose Docker 29
+        # defaults to the containerd image store, where lc cannot find
+        # its images by config digest. Back to ubuntu-latest with the fix.
+        os: [ubuntu-24.04]
         python-version: ["3.11", "3.12", "3.13"]
         include:
           # macOS is where Seatbelt is the mechanism, and the only place
@@ -44,17 +50,19 @@ jobs:
       LC_UI_TESTS_REQUIRED: "1"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7.6.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
           activate-environment: true
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5.0.0
         with:
           node-version: 22
           cache: npm
@@ -112,10 +120,12 @@ jobs:
     if: github.event_name == 'push' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7.6.0
         with:
           python-version: "3.13"
           enable-cache: true
@@ -125,7 +135,7 @@ jobs:
         run: uv sync --group dev
 
       - name: Put the floor uv first on PATH
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v7.6.0
         with:
           version: "0.7.0"