hugovk · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 11, 2026
@@ -12,3 +12,6 @@ paths:
      ignore:
      - 1st argument of function call is not assignable
      - SC2(015|038|086|091|097|098|129|155)
+     # Pending release of actionlint > 1.7.12 for `$/` self-repository syntax:
+     # https://github.com/rhysd/actionlint/issues/711
+     - reusable workflow call "\$/[^"]+" at "uses" is not following the format
@@ -0,0 +1,161 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+        - 're-actors/alls-green@v1.3.0'
+    '.github/workflows/cache-cleanup-codeql.yml': []
+    '.github/workflows/jit.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/lint.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'j178/prek-action@v3.0.0'
+    '.github/workflows/mypy.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'astral-sh/setup-uv@v10.2.0'
+    '.github/workflows/new-bugs-announce-notifier.yml':
+        - 'actions/github-script@v9.0.0'
+        - 'actions/setup-node@v7.0.0'
+    '.github/workflows/require-pr-label.yml':
+        - 'mheap/github-action-required-labels@v5.6.0'
+    '.github/workflows/reusable-check-c-api-docs.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-check-html-ids.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-cifuzz.yml':
+        - 'actions/upload-artifact@v7.0.1'
+        - 'github/codeql-action@v4.38.2'
+        - 'google/oss-fuzz@ed23f8af80ff82b25ca67cd9b101e690b8897b3f'
+    '.github/workflows/reusable-context.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-docs.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/reusable-emscripten.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.0.0'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/reusable-install.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-macos.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-san.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.1'
+    '.github/workflows/reusable-test-lazy-imports-all.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-ubuntu.yml':
+        - 'actions/cache@v6.1.0'
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/reusable-wasi.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+        - 'bytecodealliance/actions@v1.1.3'
+        - 'bytecodealliance/setup-wasi-sdk-action@v1.0.0'
+    '.github/workflows/reusable-windows.yml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/stale.yml':
+        - 'actions/stale@v11.0.0'
+    '.github/workflows/tail-call.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/verify-ensurepip-wheels.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-python@v7.0.0'
+    '.github/workflows/verify-expat.yml':
+        - 'actions/checkout@v7.0.1'
+dependencies:
+    'actions/cache@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.1':
+        ref: 'v8.0.1'
+        commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@v9.0.0':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-node@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-820762786026740c76f36085b0efc47a31fe5020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-python@v7.0.0':
+        ref: 'v7.0.0'
+        commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97'
+        owner_id: 44036562
+        repo_id: 192625525
+    'actions/stale@v11.0.0':
+        ref: 'v11.0.0'
+        commit: 'sha1-4391f3da665fdf50b6810c1a66712fb9ba21aa93'
+        owner_id: 44036562
+        repo_id: 200437066
+    'actions/upload-artifact@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        owner_id: 44036562
+        repo_id: 192625955
+    'astral-sh/setup-uv@v10.2.0':
+        ref: 'v10.2.0'
+        commit: 'sha1-c18668ad3cf93ea998bef934396af7bb5c839dc7'
+        owner_id: 115962839
+        repo_id: 846733598
+    'bytecodealliance/actions@v1.1.3':
+        ref: 'v1.1.3'
+        commit: 'sha1-9152e710e9f7182e4c29ad218e4f335a7b203613'
+        owner_id: 54038801
+        repo_id: 697422232
+    'bytecodealliance/setup-wasi-sdk-action@v1.0.0':
+        ref: 'v1.0.0'
+        commit: 'sha1-77d09f3df1e8da344d8403cf8631af8977938b4c'
+        owner_id: 54038801
+        repo_id: 1113975359
+    'github/codeql-action@v4.38.2':
+        ref: 'v4.38.2'
+        commit: 'sha1-2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2'
+        owner_id: 9919
+        repo_id: 259445878
+    'google/oss-fuzz@ed23f8af80ff82b25ca67cd9b101e690b8897b3f':
+        ref: 'master'
+        commit: 'sha1-ed23f8af80ff82b25ca67cd9b101e690b8897b3f'
+        owner_id: 1342004
+        repo_id: 63809205
+    'j178/prek-action@v3.0.0':
+        ref: 'v3.0.0'
+        commit: 'sha1-4e14d07f9231acabce116ccfca13b13dd9755ece'
+        owner_id: 10510431
+        repo_id: 1052387486
+    'mheap/github-action-required-labels@v5.6.0':
+        ref: 'v5.6.0'
+        commit: 'sha1-23e10fde7e062233401931a0eece796cd9bf3177'
+        owner_id: 59130
+        repo_id: 272521528
+    're-actors/alls-green@v1.3.0':
+        ref: 'v1.3.0'
+        commit: 'sha1-b5b5b37504aa4183270bd3d855c52a67f212be35'
+        owner_id: 46427759
+        repo_id: 434447646
@@ -41,13 +41,13 @@ jobs:
     #        || 'falsy-branch'
     #   }}
     #
-    uses: ./.github/workflows/reusable-context.yml
+    uses: $/.github/workflows/reusable-context.yml
 
   check-docs:
     name: Docs
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-docs)
-    uses: ./.github/workflows/reusable-docs.yml
+    uses: $/.github/workflows/reusable-docs.yml
 
   check-autoconf-regen:
     name: 'Check if Autoconf files are up to date'
@@ -64,7 +64,7 @@ jobs:
         run: |
           apt update && apt install git -yq
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -101,10 +101,10 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.x'
       - name: Runner image version
@@ -147,7 +147,7 @@ jobs:
     if: >-
       needs.build-context.outputs.run-tests == 'true'
       || needs.build-context.outputs.run-docs == 'true'
-    uses: ./.github/workflows/reusable-check-c-api-docs.yml
+    uses: $/.github/workflows/reusable-check-c-api-docs.yml
 
   build-windows:
     name: >-
@@ -175,7 +175,7 @@ jobs:
           # and only supported on 3.15+.
           - { arch: x64, free-threading: false, interpreter: tail-call }
           - { arch: x64, free-threading: true,  interpreter: tail-call }
-    uses: ./.github/workflows/reusable-windows.yml
+    uses: $/.github/workflows/reusable-windows.yml
     with:
       arch: ${{ matrix.arch }}
       free-threading: ${{ matrix.free-threading }}
@@ -201,7 +201,7 @@ jobs:
         exclude:
         - os: macos-26-intel
           free-threading: true
-    uses: ./.github/workflows/reusable-macos.yml
+    uses: $/.github/workflows/reusable-macos.yml
     with:
       free-threading: ${{ matrix.free-threading }}
       os: ${{ matrix.os }}
@@ -238,7 +238,7 @@ jobs:
           bolt: false
           free-threading: false
           test-opts: '-u cpu'
-    uses: ./.github/workflows/reusable-ubuntu.yml
+    uses: $/.github/workflows/reusable-ubuntu.yml
     with:
       bolt-optimizations: ${{ matrix.bolt }}
       free-threading: ${{ matrix.free-threading }}
@@ -249,7 +249,7 @@ jobs:
     name: 'Ubuntu (installed)'
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
-    uses: ./.github/workflows/reusable-install.yml
+    uses: $/.github/workflows/reusable-install.yml
 
   build-ubuntu-ssltests:
     name: 'Ubuntu SSL tests'
@@ -280,7 +280,7 @@ jobs:
       SSLLIB_DIR: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
       LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}/lib
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Runner image version
@@ -291,7 +291,7 @@ jobs:
       run: sudo ./.github/workflows/posix-deps-apt.sh
     - name: 'Restore SSL library build'
       id: cache-ssl-lib
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/${{ matrix.ssllib.name }}/${{ matrix.ssllib.version }}
         key: ${{ matrix.os }}-multissl-${{ matrix.ssllib.name }}-${{ matrix.ssllib.version }}
@@ -339,7 +339,7 @@ jobs:
 
     runs-on: ${{ matrix.runs-on }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Build and test
@@ -360,7 +360,7 @@ jobs:
         - false
         - true
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
@@ -373,13 +373,13 @@ jobs:
     name: 'Emscripten'
     needs: build-context
     if: needs.build-context.outputs.run-emscripten == 'true'
-    uses: ./.github/workflows/reusable-emscripten.yml
+    uses: $/.github/workflows/reusable-emscripten.yml
 
   build-wasi:
     name: 'WASI'
     needs: build-context
     if: needs.build-context.outputs.run-wasi == 'true'
-    uses: ./.github/workflows/reusable-wasi.yml
+    uses: $/.github/workflows/reusable-wasi.yml
 
   test-hypothesis:
     name: "Hypothesis tests on Ubuntu"
@@ -391,7 +391,7 @@ jobs:
       OPENSSL_VER: 3.5.9
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/checkout@v7.0.1
       with:
         persist-credentials: false
     - name: Register gcc problem matcher
@@ -405,7 +405,7 @@ jobs:
         echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> "$GITHUB_ENV"
     - name: 'Restore OpenSSL build'
       id: cache-openssl
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ./multissl/openssl/${{ env.OPENSSL_VER }}
         key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -452,7 +452,7 @@ jobs:
         ./python -m venv "$VENV_LOC" && "$VENV_PYTHON" -m pip install -r "${GITHUB_WORKSPACE}/Tools/requirements-hypothesis.txt"
     - name: 'Restore Hypothesis database'
       id: cache-hypothesis-database
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache@v6.1.0
       with:
         path: ${{ env.CPYTHON_BUILDDIR }}/.hypothesis/
         key: hypothesis-database-${{ github.head_ref || github.run_id }}
@@ -479,7 +479,7 @@ jobs:
           -x test_subprocess \
           -x test_signal \
           -x test_sysconfig
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@v7.0.1
       if: always()
       with:
         name: hypothesis-example-db
@@ -489,7 +489,7 @@ jobs:
     name: 'Lazy imports enabled'
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-tests)
-    uses: ./.github/workflows/reusable-test-lazy-imports-all.yml
+    uses: $/.github/workflows/reusable-test-lazy-imports-all.yml
 
   build-san:
     # ${{ '' } is a hack to nest jobs under the same sidebar category.
@@ -516,7 +516,7 @@ jobs:
         - check-name: Memory
           sanitizer: MSan
           free-threading: false
-    uses: ./.github/workflows/reusable-san.yml
+    uses: $/.github/workflows/reusable-san.yml
     with:
       sanitizer: ${{ matrix.sanitizer }}
       free-threading: ${{ matrix.free-threading }}
@@ -528,7 +528,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Runner image version
@@ -598,7 +598,7 @@ jobs:
               && 'no-exclude'
               || 'python3-libraries'
             }}
-    uses: ./.github/workflows/reusable-cifuzz.yml
+    uses: $/.github/workflows/reusable-cifuzz.yml
     with:
       oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }}
       sanitizer: ${{ matrix.sanitizer }}
@@ -630,7 +630,7 @@ jobs:
 
     steps:
     - name: Check whether the needed jobs succeeded or failed
-      uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35
+      uses: re-actors/alls-green@v1.3.0
       with:
         allowed-failures: >-
           build-android,