governance / Workflow security linter fails on main: .github/workflows/actions.lock flagged as unpinned action #221

The non-required check governance / Workflow security linter fails on main (4341d6e) and on every PR, independent of the PR's diff (seen on #219).

Output: ERROR: Found unpinned actions: -> .github/workflows/actions.lock:59: uses:. The linter greps every file under .github/workflows/, including the actions.lock file, which is not a workflow.

Acceptance criteria

• Either restrict the linter's grep to *.yml/*.yaml workflow files, or fix the entry at actions.lock:59.
• governance / Workflow security linter passes on main.

🤖 Generated with Claude Code