[hugovk]

GitHub Actions now supports lockfiles for workflows.

See https://hugovk.dev/blog/2026/lock-github-actions/

---

Also update zizmor in prek to support lockfiles (I also updated the other hooks, they don't trigger any code changes).

It has a new finding about new $/ self-repository syntax, let's fix it:

• https://docs.zizmor.sh/audits/#self-repository
• https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/

  help[self-repository]: use GitHub's dedicated self-repository syntax
     --> .github/workflows/reusable-docs.yml:107:11
      |
  104 |     name: 'Check for removed HTML IDs'
      |     ---------------------------------- this job
  ...
  107 |     uses: ./.github/workflows/reusable-check-html-ids.yml
      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
      |
      = note: audit confidence → High
      = note: this finding has an auto-fix

---

However, http://github.com/rhysd/actionlint doesn't yet support the $/ syntax (rhysd/actionlint#711), so ignore that in actionlint.

We're already ignoring it's lack of support for ubuntu-26.04* runners (rhysd/actionlint#682).

There are pending PRs, but the tool author isn't active, so we could consider this fork:
rhysd/actionlint#719 (comment). Perhaps when we need to add a third ignore...

---

Finally, zizmor also flags this:

  help[adhoc-packages]: ad-hoc installation of packages
    --> .github/workflows/new-bugs-announce-notifier.yml:21:14
     |
  21 |       - run: npm install mailgun.js form-data
     |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ installs a package outside of a lockfile
     |         |
     |         this step
     |
     = note: audit confidence → High

I added a temporary zizmor ignore on that, let's tackle that in a follow up with an npm lockfile or a Python stdlib version.