Summary

• Pin dessant/lock-threads@v6, actions/checkout@v4, and actions/upload-artifact@v4 in .github/workflows/{lock,regress}.yml to their current tag's full commit SHA, keeping the tag as a trailing comment.
• Tags are mutable — a compromised maintainer account (or a supply-chain attack on the action's own repo, as happened to tj-actions/changed-files in 2025) can retarget a tag your workflow already trusts, silently changing what code runs with that job's token.
• lock.yml runs weekly with an issues: write, pull-requests: write, discussions: write token, so a hijacked lock-threads tag would have real reach even though the workflow never runs on untrusted PR code.

Test plan

• Both modified files parse as valid YAML.
• Diffed to confirm only the three uses: lines changed.

🤖 Generated with Claude Code