ci: Add locked-in tool; fix violations

Adds https://github.com/asymmetric-research/locked-in as a CI workflow
using the config from the main Guardian repo.

Fixes violations:
- Use a lockfile where available
- Add a few ignore directives for false positives

Author: johnsaigle

.github/workflows/locked-in.yml

@@ -0,0 +1,27 @@
+name: locked-in
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  locked-in:
+    runs-on: ubuntu-latest
+    env:
+      LOCKED_IN_COMMIT: 7978ff8e3717a30c18352ab1eb687e5f8210a5ac # v0.3.1
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install locked-in from pinned source
+        run: cargo install --locked --git https://github.com/asymmetric-research/locked-in --rev "$LOCKED_IN_COMMIT" locked-in
+      - name: Run locked-in
+        run: locked-in

.github/workflows/prettier.yml

@@ -40,7 +40,7 @@ jobs:
           echo "Actual Prettier version: $ACTUAL_VERSION"
           if [ "$EXPECTED_VERSION" != "$ACTUAL_VERSION" ]; then
             echo "Error: Prettier version mismatch!"
-            echo "This usually means bun.lock is out of sync with package.json - try running 'bun install' locally and committing the updated bun.lock"
+            echo "bun.lock is out of sync with package.json — regenerate it and commit the result"
             exit 1
           fi
           echo "✓ Prettier version matches"

CONTRIBUTING.md

@@ -20,6 +20,7 @@ Do not change the dependencies of the package.json by hand!
 Instead:
 
 - When initially installing OR pulling what has been changed: `bun ci`.
+  <!-- locked-in: ignore[bun-frozen-lockfile] -->
   If you do not do this, you may not get exactly what is specified in the file, inadvertently update dependencies, or even pull exploits down to your machine! **Never use `bun install` for this use case**.
 - When needing to add or update a package: `bun add <package>@<version>`. If you do not do this, you may inadvertently update other packages or fail to update the lock file.
 - When needing to remove a package: `bun remove <package>`. If you do not do this, you may inadvertently update other packages or fail to update the lock file.

cli/install.sh

@@ -147,7 +147,7 @@ function select_branch {
 function install_cli {
   cd "$1"
 
-  bun install
+  bun install --frozen-lockfile
 
   # Build using root script which handles dependency ordering
   # (sdk-definitions-ntt must be built before other packages)

sdk/README.md

@@ -7,6 +7,7 @@ The NTT TypeScript SDK is is a collection of packages that provide a simple inte
 From this directory, install package dependencies and build contract dependencies
 
 ```bash
+<!-- locked-in: ignore[bun-frozen-lockfile] -->
 bun install
 bun run build:deps
 ```
@@ -16,9 +17,13 @@ bun run build:deps
 The SDK contains multiple packages. The `@wormhole-foundation/sdk-definitions-ntt` package contains the NTT interface and types. The `@wormhole-foundation/sdk-evm-ntt` and `@wormhole-foundation/sdk-solana-ntt` packages contain the EVM and Solana implementations of the NTT interface, respectively. Install one or both of these packages, depending on which platforms you want to interact with. The `@wormhole-foundation/sdk-route-ntt` package contains the Wormhole SDK `Route` for NTT (more on this in the Usage section).
 
 ```bash
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-definitions-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-evm-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-solana-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-route-ntt
 ```
 

solana/Makefile

@@ -60,7 +60,7 @@ clean:
 	rm -rf .anchor node_modules
 
 node_modules:
-	bun install
+	bun install --frozen-lockfile
 
 
 #######################