ci: Action を最新版に上げて actions.lock で固定する

.github/workflows/actions.lock

@@ -0,0 +1,72 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.1.0'
+        - 'pnpm/action-setup@v6.1.0'
+    '.github/workflows/mirror-release.yml':
+        - 'actions/attest-build-provenance@v4.2.2'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.1.0'
+        - 'pnpm/action-setup@v6.1.0'
+    '.github/workflows/publish-obsidian.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.1.0'
+        - 'pnpm/action-setup@v6.1.0'
+    '.github/workflows/publish-vscode.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.1.0'
+        - 'azure/login@v3.1.0'
+        - 'pnpm/action-setup@v6.1.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'actions/setup-node@v7.1.0'
+        - 'changesets/action@v1.9.0'
+        - 'pnpm/action-setup@v6.1.0'
+dependencies:
+    'actions/attest-build-provenance@v4.2.2':
+        ref: 'v4.2.2'
+        commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
+        owner_id: 44036562
+        repo_id: 760702757
+        uses:
+            - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+    'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
+        ref: 'v4.2.1'
+        commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/setup-node@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
+        owner_id: 44036562
+        repo_id: 189476904
+    'azure/login@v3.1.0':
+        ref: 'v3.1.0'
+        commit: 'sha1-a641126d1b8aa4d1fa005f4f92df94a3a4c4c906'
+        owner_id: 6844498
+        repo_id: 210798615
+    'changesets/action@v1.9.0':
+        ref: 'v1.9.0'
+        commit: 'sha1-a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d'
+        owner_id: 51163350
+        repo_id: 202093906
+    'pnpm/action-setup@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-ea17c68df8912ef543352723c149a84f56e3d413'
+        owner_id: 21320719
+        repo_id: 262289747

.github/workflows/ci.yml

@@ -11,11 +11,11 @@ jobs:
     name: ci
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 24
           cache: pnpm

.github/workflows/mirror-release.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 22
           cache: pnpm
@@ -54,7 +54,7 @@ jobs:
           fi
 
       # Signed before the release exists, so nothing can be attached unattested.
-      - uses: actions/attest-build-provenance@v3
+      - uses: actions/attest-build-provenance@v4.2.2
         with:
           subject-path: |
             dist/main.js

.github/workflows/publish-obsidian.yml

@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
 
       - id: version
         name: Decide whether this is a release
@@ -65,10 +65,10 @@ jobs:
           fi
 
       - if: steps.version.outputs.publish == 'true'
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@v6.1.0
 
       - if: steps.version.outputs.publish == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/publish-vscode.yml

@@ -40,7 +40,7 @@ jobs:
       AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
       AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           # The previous commit, to see whether the version moved.
           fetch-depth: 2
@@ -66,10 +66,10 @@ jobs:
             echo "バージョンは $current のまま。公開しません"
           fi
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6.1.0
         if: steps.version.outputs.publish == 'true'
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7.1.0
         if: steps.version.outputs.publish == 'true'
         with:
           node-version: 24
@@ -144,7 +144,7 @@ jobs:
       # it — though PATs are not going away, whatever anyone half-remembers.
       - name: Sign in to Entra ID
         if: steps.version.outputs.publish == 'true' && env.AZURE_CLIENT_ID != ''
-        uses: azure/login@v2
+        uses: azure/login@v3.1.0
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}

.github/workflows/release.yml

@@ -20,18 +20,18 @@ jobs:
       # resulting push trigger required CI checks. App tokens auto-rotate hourly,
       # so there is no PAT expiry to manage.
       - id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@v3.3.0
         with:
           client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           token: ${{ steps.app-token.outputs.token }}
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@v6.1.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 24
           cache: pnpm
@@ -40,7 +40,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Create Release PR or Publish to npm
-        uses: changesets/action@v1
+        uses: changesets/action@v1.9.0
         with:
           version: pnpm ci:version
           publish: pnpm ci:publish