From f0d494ee6d4cb7d61d65b3de2620e8bf01981bc0 Mon Sep 17 00:00:00 2001
From: John Saigle <john@asymmetric.re>
Date: Tue, 21 Jul 2026 15:43:09 -0400
Subject: [PATCH] ci: Add locked-in tool; fix violations

Adds https://github.com/asymmetric-research/locked-in as a CI workflow
using the config from the main Guardian repo.

Fixes violations:
- Use a lockfile where available
- Add a few ignore directives for false positives
---
 .github/workflows/locked-in.yml | 27 +++++++++++++++++++++++++++
 .github/workflows/prettier.yml  |  2 +-
 CONTRIBUTING.md                 |  1 +
 cli/install.sh                  |  2 +-
 sdk/README.md                   |  5 +++++
 solana/Makefile                 |  2 +-
 6 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/locked-in.yml

diff --git a/.github/workflows/locked-in.yml b/.github/workflows/locked-in.yml
new file mode 100644
index 000000000..a7b3cbe43
--- /dev/null
+++ b/.github/workflows/locked-in.yml
@@ -0,0 +1,27 @@
+name: locked-in
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  locked-in:
+    runs-on: ubuntu-latest
+    env:
+      LOCKED_IN_COMMIT: 7978ff8e3717a30c18352ab1eb687e5f8210a5ac # v0.3.1
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install locked-in from pinned source
+        run: cargo install --locked --git https://github.com/asymmetric-research/locked-in --rev "$LOCKED_IN_COMMIT" locked-in
+      - name: Run locked-in
+        run: locked-in
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index e06b4f422..53152c50a 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -40,7 +40,7 @@ jobs:
           echo "Actual Prettier version: $ACTUAL_VERSION"
           if [ "$EXPECTED_VERSION" != "$ACTUAL_VERSION" ]; then
             echo "Error: Prettier version mismatch!"
-            echo "This usually means bun.lock is out of sync with package.json - try running 'bun install' locally and committing the updated bun.lock"
+            echo "bun.lock is out of sync with package.json — regenerate it and commit the result"
             exit 1
           fi
           echo "✓ Prettier version matches"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3156a11e1..b2108149f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -20,6 +20,7 @@ Do not change the dependencies of the package.json by hand!
 Instead:
 
 - When initially installing OR pulling what has been changed: `bun ci`.
+  <!-- locked-in: ignore[bun-frozen-lockfile] -->
   If you do not do this, you may not get exactly what is specified in the file, inadvertently update dependencies, or even pull exploits down to your machine! **Never use `bun install` for this use case**.
 - When needing to add or update a package: `bun add <package>@<version>`. If you do not do this, you may inadvertently update other packages or fail to update the lock file.
 - When needing to remove a package: `bun remove <package>`. If you do not do this, you may inadvertently update other packages or fail to update the lock file.
diff --git a/cli/install.sh b/cli/install.sh
index 2adab5819..79200a4f0 100755
--- a/cli/install.sh
+++ b/cli/install.sh
@@ -147,7 +147,7 @@ function select_branch {
 function install_cli {
   cd "$1"
 
-  bun install
+  bun install --frozen-lockfile
 
   # Build using root script which handles dependency ordering
   # (sdk-definitions-ntt must be built before other packages)
diff --git a/sdk/README.md b/sdk/README.md
index 2d20d24a9..5fc3ce50b 100644
--- a/sdk/README.md
+++ b/sdk/README.md
@@ -7,6 +7,7 @@ The NTT TypeScript SDK is is a collection of packages that provide a simple inte
 From this directory, install package dependencies and build contract dependencies
 
 ```bash
+<!-- locked-in: ignore[bun-frozen-lockfile] -->
 bun install
 bun run build:deps
 ```
@@ -16,9 +17,13 @@ bun run build:deps
 The SDK contains multiple packages. The `@wormhole-foundation/sdk-definitions-ntt` package contains the NTT interface and types. The `@wormhole-foundation/sdk-evm-ntt` and `@wormhole-foundation/sdk-solana-ntt` packages contain the EVM and Solana implementations of the NTT interface, respectively. Install one or both of these packages, depending on which platforms you want to interact with. The `@wormhole-foundation/sdk-route-ntt` package contains the Wormhole SDK `Route` for NTT (more on this in the Usage section).
 
 ```bash
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-definitions-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-evm-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-solana-ntt
+<!-- locked-in: ignore[bun-version-pin] -->
 bun add @wormhole-foundation/sdk-route-ntt
 ```
 
diff --git a/solana/Makefile b/solana/Makefile
index fadee2ea2..0ffc9fc95 100644
--- a/solana/Makefile
+++ b/solana/Makefile
@@ -60,7 +60,7 @@ clean:
 	rm -rf .anchor node_modules
 
 node_modules:
-	bun install
+	bun install --frozen-lockfile
 
 
 #######################