stefanvanburen · Nov 12, 2026
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
@@ -0,0 +1,102 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/add-to-project.yaml': []
+    '.github/workflows/ci.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-go@v7.0.0'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'codecov/codecov-action@v7.1.1'
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.39.3'
+    '.github/workflows/docs.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/deploy-pages@v5.0.1'
+        - 'actions/upload-pages-artifact@v5.0.0'
+        - 'astral-sh/setup-uv@v10.3.3'
+    '.github/workflows/pr-title.yaml': []
+    '.github/workflows/release-fastapi.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+    '.github/workflows/release-grpchealth.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+    '.github/workflows/release-grpcreflect.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+    '.github/workflows/release-otel.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+    '.github/workflows/release.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.3.3'
+        - 'pypa/gh-action-pypi-publish@v1.14.3'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
+        owner_id: 44036562
+        repo_id: 438112499
+    'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-go@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-b7ad1dad31e06c5925ef5d2fc7ad053ef454303e'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
+        ref: 'v6.2.0'
+        commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+        ref: 'v7.0.0'
+        commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-pages-artifact@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
+        owner_id: 44036562
+        repo_id: 496012378
+        uses:
+            - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'astral-sh/setup-uv@v10.3.3':
+        ref: 'v10.3.3'
+        commit: 'sha1-68559e99cc807c1eb7e9238fd43a15bba460eec2'
+        owner_id: 115962839
+        repo_id: 846733598
+    'codecov/codecov-action@v7.1.1':
+        ref: 'v7.1.1'
+        commit: 'sha1-303a32d7a59b442fa8d48b6a1cc6825c09c847a5'
+        owner_id: 8226205
+        repo_id: 200299178
+        uses:
+            - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
+    'github/codeql-action@v4.39.3':
+        ref: 'v4.39.3'
+        commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066'
+        owner_id: 9919
+        repo_id: 259445878
+    'pypa/gh-action-pypi-publish@v1.14.3':
+        ref: 'v1.14.3'
+        commit: 'sha1-7245906fb61fa33a13554f9d5fb856fe61758086'
+        owner_id: 647025
+        repo_id: 178055147
+        uses:
+            - 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -68,16 +68,16 @@ jobs:
       PYTHON_GIL: ${{ endsWith(matrix.python, 't') && '0' || '' }}
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
         with:
           python-version: ${{ matrix.python }}
 
       # For conformance runner
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@v7.0.0
         with:
           go-version: "^1.26"
           # The conformance runner is installed with `go run pkg@version`
@@ -119,7 +119,7 @@ jobs:
         if: ${{ !startsWith(matrix.os, 'windows-') }}
         run: uv run poe test-conformance ${{ matrix.coverage == 'cov' && '--cov=connectrpc --cov-report=xml' || '' }}
 
-      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+      - uses: codecov/codecov-action@v7.1.1
         if: ${{ matrix.coverage == 'cov' }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -128,11 +128,11 @@ jobs:
     runs-on: ubuntu-26.04
     needs: ci
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - run: uv sync --frozen
 
@@ -157,3 +157,21 @@ jobs:
       - name: check wheels at dependency floors
         # The oldest supported Python, which allows the oldest dependencies.
         run: uv run --python 3.11 scripts/check_wheels.py dist/*.whl
+
+  actions-lock:
+    runs-on: ubuntu-26.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      # Fails when actions.lock is out of sync with the workflows or a
+      # locked pin no longer verifies upstream.
+      - run: gh extension install github/gh-actions-lock --pin v0.4.1
+
+      - run: gh actions-lock --verify
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -25,15 +25,15 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        uses: github/codeql-action/init@v4.39.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        uses: github/codeql-action/analyze@v4.39.3
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
@@ -43,17 +43,17 @@ jobs:
     runs-on: ubuntu-26.04
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - run: uv run poe docs-build
 
-      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+      - uses: actions/upload-pages-artifact@v5.0.0
         if: github.event_name != 'pull_request'
         with:
           path: site
 
-      - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+      - uses: actions/deploy-pages@v5.0.1
         if: github.event_name != 'pull_request'
         id: deployment
diff --git a/.github/workflows/release-fastapi.yaml b/.github/workflows/release-fastapi.yaml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-26.04
     environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - name: check versions match the tag
         if: github.ref_type == 'tag'
@@ -37,7 +37,7 @@ jobs:
         working-directory: connectrpc-fastapi
 
       - name: publish connectrpc-fastapi
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
           skip-existing: true
diff --git a/.github/workflows/release-grpchealth.yaml b/.github/workflows/release-grpchealth.yaml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-26.04
     environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - name: check versions match the tag
         if: github.ref_type == 'tag'
@@ -37,7 +37,7 @@ jobs:
         working-directory: connectrpc-grpchealth
 
       - name: publish connectrpc-grpchealth
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
           skip-existing: true
diff --git a/.github/workflows/release-grpcreflect.yaml b/.github/workflows/release-grpcreflect.yaml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-26.04
     environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - name: check versions match the tag
         if: github.ref_type == 'tag'
@@ -37,7 +37,7 @@ jobs:
         working-directory: connectrpc-grpcreflect
 
       - name: publish connectrpc-grpcreflect
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
           skip-existing: true
diff --git a/.github/workflows/release-otel.yaml b/.github/workflows/release-otel.yaml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-26.04
     environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - name: check versions match the tag
         if: github.ref_type == 'tag'
@@ -37,7 +37,7 @@ jobs:
         working-directory: connectrpc-otel
 
       - name: publish connectrpc-otel
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
           skip-existing: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-26.04
     environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
 
-      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - uses: astral-sh/setup-uv@v10.3.3
 
       - name: check versions match the tag
         if: github.ref_type == 'tag'
@@ -39,7 +39,7 @@ jobs:
         working-directory: protoc-gen-connectrpc
 
       - name: publish
-        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        uses: pypa/gh-action-pypi-publish@v1.14.3
         with:
           repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
           skip-existing: true
diff --git a/renovate.json b/renovate.json
@@ -23,6 +23,14 @@
       "matchStrings": ["VERSION_CONFORMANCE = \"(?<currentValue>[^\"]+)\""],
       "depNameTemplate": "connectrpc.com/conformance",
       "datasourceTemplate": "go"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^\\.github/workflows/[^/]+\\.ya?ml$/"],
+      "matchStrings": [
+        "gh extension install (?<depName>github/gh-actions-lock) --pin (?<currentValue>\\S+)"
+      ],
+      "datasourceTemplate": "github-releases"
     }
   ],
   "packageRules": [