Adopt GitHub Actions Lockfiles

GitHub Actions Lockfiles are now in technical preview:

• https://github.com/github/gh-actions-lock/discussions/3
• https://github.com/cli/cli/issues/13314

The GitHub community design discussion: https://github.com/orgs/community/discussions/194494

It provides true dependency tree pinning akin to package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.

Renovate has added support for the lockfiles: https://github.com/renovatebot/renovate/pull/45199

From https://github.com/renovatebot/renovate/pull/45199:

gh actions-lock rewrites the workflows it manages back to plain refs
when it regenerates them, which strips out any inline digest pin

Hence, this necessarily replaces: https://github.com/loopbackio/security/issues/27

Workflow

Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.

Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456

Inizia dalla documentazione collegata sull’uso di GitHub Actions Lockfiles e dalla pull request di Renovate, quindi confronta l’approccio proposto con il lavoro precedente nell’issue 27. Identifica quali workflow del repository sono interessati; il lavoro è completato quando i workflow applicabili adottano e impongono i lockfile invece del precedente pinning degli hash delle dipendenze immediate.