[lf-releng-code-monkey-bot]

INFO The workflow Copilot review request was accepted but no Copilot reviewer was added; no Copilot review was requested for this pull request, so a maintainer should request one.

Closes #74

Authored by an AI agent; human review required

• Issue: CI: Bump every action pin to its latest release #74
• Model: claude-opus-5.5 via GitHub Copilot CLI
• Run: https://github.com/lfreleng-actions/github-code-monkey-bot/actions/runs/40857798922
• Base: caa803d22a1b6f9b7265b8ca1be2a6ce2aaf36ee

Command	Exit
git ls-remote https://github.com/<owner>/<repo> 'refs/tags/<tag>*' (all 7 coordinates)	0
prek run --files <9 changed files>	0
zizmor --persona auditor .github/workflows/	0
aislop scan --changes --json	0
git commit -s (prek commit-msg hooks incl. gitlint)	0

The github-code-monkey-bot workflow opened this pull request.
Nobody has merged it; a maintainer must review it first.
Review findings on this pull request are answered by a later revision round of this workflow, up to ten rounds; a maintainer must act on any finding that remains after that, and reviews every round before merge.

---

Summary

Moves every action pin that lagged its latest release to a commit SHA of that release, in one commit, rather than waiting for eight separate Dependabot pull requests after the seven-day cooldown.

Coordinate	From	To	Refs
lfreleng-actions/checkout-gerrit-change-action	v1.1.2	v1.2.1 (f0dd3d4d)	4
lfreleng-actions/gerrit-review-action (examples)	v1.1.3	v1.2.0 (d56b0b5c)	4
generic-workflows release.yaml / clear-action-cache.yaml	v0.5.0	v0.6.1 (04672a98)	2
security-workflows openssf-scorecard.yaml	v0.9.5	v0.9.7 (378fcc19)	1
astral-sh/setup-uv	v10.3.2	v10.3.3 (68559e99)	1
lfreleng-actions/.github allow-list (input defaults, release-drafter config)	v0.17.2	v0.19.0 (6d4a65c5)	3
Brief snippet: harden-runner-block-action	v0.2.1	v0.14.0 (e5e8179f)	1
Brief: allow-list path	v0.1.1	v0.19.0 (6d4a65c5)	1

In docs/DOCS_WORKFLOWS_BRIEF.md the sentence after the allow-list path now gives the file's line count at v0.19.0: 796, up from 514.

The workflow step-security/harden-runner pins (v2.22.3) and harden-runner-block-action pins (v0.14.0) were already current, so this change leaves them alone. The all-zero REPLACE: vX.Y.Z placeholder pins in examples/ also stay as they are. No with: block changes.

Validation

• git ls-remote for each tag: every new SHA matches the dereferenced (^{}) commit, never the tag object.
• The allow-list at 6d4a65c5, .github/harden-runner/lfreleng-actions/allow_list.txt, has 796 lines (wc -l).
• No old SHA from the issue's table is left under .github/, examples/ or docs/.
• grep shows only 46b06cea for step-security/harden-runner@ and only e5e8179f for harden-runner-block-action@.
• prek run --files <changed files>: all hooks passed (actionlint, yamllint, zizmor, markdownlint, workflow schema checks). The commit-msg gitlint hook also passed.
• zizmor --persona auditor .github/workflows/: no findings.
• aislop scan --changes --json: the diagnostics array is empty. The repository has no Python or Go in scope.

For reviewers

• I took the compatibility of the new action versions (new optional inputs only) from the issue and did not re-read each release's action.yaml. The CI run on this pull request is the real check.
• v0.19.0 of the shared allow-list replaces aswf.jfrog.io with linuxfoundation.jfrog.io. This is a behavioural change for callers that use the default allow-list in block mode.
• Close any Dependabot pull request that later tries to move harden-runner back to v2.22.2 (see CI(actions): Bump step-security/harden-runner from 2.22.1 to 2.22.2 node-workflows#218).

[Copilot]

🟢 Approval recommended

No active review issues are reported for the workflow and example dependency-pin updates.

No open issues 🎉

What changed in this PR

Updates outdated action, reusable-workflow, and allow-list pins across the documentation workflows and examples, addressing #74 without waiting for separate Dependabot updates.

Changes:

• Bumps dependencies to the release commit SHAs specified in #74, preserving existing action inputs.
• Updates shared allow-list references to v0.19.0 and refreshes the brief’s example pins and line count.
• Leaves already-current workflow hardening pins and consumer placeholder pins unchanged.

File	Description
examples/​docs-build/​gerrit.yaml	Updates Gerrit review actions to v1.2.0.
examples/​docs-build/​gerrit-merge.yaml	Updates Gerrit notification actions to v1.2.0.
docs/​DOCS_WORKFLOWS_BRIEF.md	Refreshes hardening and allow-list examples and the documented line count.
.github/​workflows/​release.yaml	Updates the reusable release workflow to v0.6.1.
.github/​workflows/​release-drafter.yaml	Updates the shared allow-list pin to v0.19.0.
.github/​workflows/​openssf-scorecard.yaml	Updates the security workflow to v0.9.7.
.github/​workflows/​docs-build.yaml	Updates Gerrit checkout, setup-uv, and default allow-list pins.
.github/​workflows/​docs-audit.yaml	Updates Gerrit checkout and default allow-list pins.
.github/​workflows/​clear-action-cache.yaml	Updates the reusable cache-clearing workflow to v0.6.1.

_{Review effort: Balanced}