feat(ci): verify workflow dependency lockfile

.github/workflows/actions.lock

@@ -0,0 +1,13 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/audit-gha-workflows.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+dependencies:
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629

.github/workflows/audit-gha-workflows.yml

@@ -7,6 +7,27 @@ on:
 permissions:
   contents: read
 jobs:
+  actions-lock:
+    name: Verify workflow dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install verified lockfile tool
+        run: |
+          set -euo pipefail
+          tool="$RUNNER_TEMP/gh-actions-lock"
+          curl --fail --silent --show-error --location --retry 3 \
+            https://github.com/github/gh-actions-lock/releases/download/v0.2.0/linux-amd64 --output "$tool"
+          printf '%s  %s\n' 'd0588b09bb8fafbe096d27b284dfaac609a2ddbdc06415512c4ca2c685a883377d49dcd290d12378a1fe5ee0ddf1c396dabbd7632daac7d2f027910fc6581e16' "$tool" | sha512sum --check --strict
+          chmod +x "$tool"
+      - name: Verify workflow dependencies
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: '"$RUNNER_TEMP/gh-actions-lock" --verify --no-interactive --json --hostname github.com'
   zizmor:
     name: Audit GitHub Actions
     runs-on: ubuntu-latest