[hugovk]

GitHub Actions now supports lockfiles for workflows.

See https://hugovk.dev/blog/2026/lock-github-actions/

---

Also update zizmor in prek to support lockfiles (I also updated the other hooks, they don't trigger any code changes).

It has a new finding about new $/ self-repository syntax, let's fix it:

• https://docs.zizmor.sh/audits/#self-repository
• https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax/

  help[self-repository]: use GitHub's dedicated self-repository syntax
     --> .github/workflows/reusable-docs.yml:107:11
      |
  104 |     name: 'Check for removed HTML IDs'
      |     ---------------------------------- this job
  ...
  107 |     uses: ./.github/workflows/reusable-check-html-ids.yml
      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
      |
      = note: audit confidence → High
      = note: this finding has an auto-fix

---

However, https://github.com/rhysd/actionlint doesn't yet support the $/ syntax (rhysd/actionlint#711), so ignore that in actionlint.

We're already ignoring it's lack of support for ubuntu-26.04* runners (rhysd/actionlint#682).

There are pending PRs, but the tool author isn't active, so we could consider this fork:
rhysd/actionlint#719 (comment). Perhaps when we need to add a third ignore...

---

Finally, zizmor also flags this:

  help[adhoc-packages]: ad-hoc installation of packages
    --> .github/workflows/new-bugs-announce-notifier.yml:21:14
     |
  21 |       - run: npm install mailgun.js form-data
     |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ installs a package outside of a lockfile
     |         |
     |         this step
     |
     = note: audit confidence → High

I added a temporary zizmor ignore on that, let's tackle that in a follow up with an npm lockfile or a Python stdlib version.

[miss-islington-app]

Thanks @hugovk for the PR 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @hugovk, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 16b9ac289d655cf88843752af9f9883fe973e2f1 3.15

[bedevere-app]

GH-161882 is a backport of this pull request to the 3.15 branch.