[PiotrRogulski]

Tests no longer run on tag pushes

Pushing a release tag ran the test workflow of every other package. When leancode_lint-v28.0.0 was pushed, 18 test workflows ran and 8 of them failed. Each *-test.yml had tags-ignore: ['<package>-v*'] under push, so every other package's tag matched it, and GitHub doesn't apply paths filters to tag pushes. This removes tags-ignore from all 18 workflows. With only branches: [master] left, tag pushes no longer start test workflows. Pushes to master already ran only the tests of the package that changed, and they still do.

Workflow lockfile

This adopts workflow dependency lockfiles, which are in public preview.

• .github/workflows/actions.lock, written by gh actions-lock v0.3.0, pins every action that the 38 workflows use to a commit, including the 7 actions that composite actions use, such as mikefarah/yq@master from pub-release.
• The uses: lines name full release tags, such as actions/checkout@v7.0.1, instead of floating tags (@v3) or commit SHAs. The lockfile pins the commits.
• The new lockfile workflow runs gh actions-lock --verify on pull requests that change .github/workflows/, as the enforcement guide suggests.
• Dependabot now also updates GitHub Actions, weekly and in one grouped pull request. According to GitHub's docs, its pull requests update the lockfile too.
• .gitattributes marks the lockfile as linguist-generated, so its diff is collapsed in pull requests.

Version bumps

Action	Before	After
actions/checkout	v3, v4, v4.4.0 SHA	v7.0.1
dart-lang/setup-dart	v1	v1.8.1
subosito/flutter-action	v2	v2.23.0
actions/cache	v4	v6.1.0
actions/labeler	v5	v7.0.0
codecov/codecov-action	v1	v7.1.1
pana-score	pana-score-v1.3 SHA	pana-score-v1.3

Before merging

• Codecov: v1 runs the old bash uploader without a token. Since v4, an upload needs a CODECOV_TOKEN secret, unless the organization allows tokenless uploads for public repositories in its Codecov settings. Without either, the upload step logs an error but doesn't fail the job.
• Labeler: checkout v7 refuses to check out a fork's code under pull_request_target. The labeler only checks out the base branch, so it should be unaffected, but this hasn't been tested.
• The Require lockfile policy is a repository setting that has to be turned on by hand.

Testing

gh actions-lock --verify prints "All 38 workflows valid" on this branch. The lockfile workflow and every package's test workflow run on this pull request, because it changes each of their files.

🤖 Generated with Claude Code