pivot: detached lockfile

.github/workflows/actions.lock

@@ -0,0 +1,68 @@
+# This file is machine-generated by `gh actions-pin`.
+# Do not edit by hand; run `gh actions-pin` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.1'
+workflows:
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v6.0.2:sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        - 'cli/gh-extension-precompile@v2.1.0:sha1-9e2237c30f869ad3bcaed6a4be2cd43564dd421b'
+    '.github/workflows/sync-early-access-release.yml':
+        - 'actions/checkout@v6.0.2:sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+    '.github/workflows/test.yml':
+        - 'actions/checkout@v5.0.1:sha1-93cb6efe18208431cddfb8368fd83d5badbf9bfd'
+        - 'actions/setup-go@v6.4.0:sha1-4a3601121dd01d1626a1e23e37211e3254c1c06c'
+dependencies:
+    'actions/attest-build-provenance@predicate@1.1.4:sha1-36fa7d009e22618ca7cd599486979b8150596c74':
+        tag: 'predicate@1.1.4'
+        branch: 'main'
+        commit: 'sha1-36fa7d009e22618ca7cd599486979b8150596c74'
+        owner_id: 44036562
+        repo_id: 760702757
+    'actions/attest-build-provenance@v1.4.4:sha1-ef244123eb79f2f7a7e75d99086184180e6d0018':
+        tag: 'v1.4.4'
+        branch: 'main'
+        commit: 'sha1-ef244123eb79f2f7a7e75d99086184180e6d0018'
+        owner_id: 44036562
+        repo_id: 760702757
+        uses:
+            - 'actions/attest-build-provenance@predicate@1.1.4:sha1-36fa7d009e22618ca7cd599486979b8150596c74'
+            - 'actions/attest@v1.4.1:sha1-67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d'
+    'actions/attest@v1.4.1:sha1-67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d':
+        tag: 'v1.4.1'
+        branch: 'main'
+        commit: 'sha1-67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/checkout@v5.0.1:sha1-93cb6efe18208431cddfb8368fd83d5badbf9bfd':
+        tag: 'v5.0.1'
+        branch: 'releases/v5'
+        commit: 'sha1-93cb6efe18208431cddfb8368fd83d5badbf9bfd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v6.0.2:sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd':
+        tag: 'v6.0.2'
+        branch: 'main'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/setup-go@v5.6.0:sha1-40f1582b2485089dde7abd97c1529aa768e1baff':
+        tag: 'v5.6.0'
+        branch: 'releases/v5'
+        commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff'
+        owner_id: 44036562
+        repo_id: 192624594
+    'actions/setup-go@v6.4.0:sha1-4a3601121dd01d1626a1e23e37211e3254c1c06c':
+        tag: 'v6.4.0'
+        branch: 'main'
+        commit: 'sha1-4a3601121dd01d1626a1e23e37211e3254c1c06c'
+        owner_id: 44036562
+        repo_id: 192624594
+    'cli/gh-extension-precompile@v2.1.0:sha1-9e2237c30f869ad3bcaed6a4be2cd43564dd421b':
+        tag: 'v2.1.0'
+        branch: 'trunk'
+        commit: 'sha1-9e2237c30f869ad3bcaed6a4be2cd43564dd421b'
+        owner_id: 59704711
+        repo_id: 421583656
+        uses:
+            - 'actions/attest-build-provenance@v1.4.4:sha1-ef244123eb79f2f7a7e75d99086184180e6d0018'
+            - 'actions/setup-go@v5.6.0:sha1-40f1582b2485089dde7abd97c1529aa768e1baff'

.github/workflows/release.yml

@@ -12,8 +12,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: cli/gh-extension-precompile@v2
+      - uses: actions/checkout@v6.0.2
+      - uses: cli/gh-extension-precompile@v2.1.0
         with:
           generate_attestations: true
           go_version_file: go.mod
@@ -26,12 +26,3 @@ jobs:
       tag: ${{ github.ref_name }}
     secrets:
       ACTIONS_LOCKED_DEPENDENCIES_RELEASE_PAT: ${{ secrets.ACTIONS_LOCKED_DEPENDENCIES_RELEASE_PAT }}
-
-# Automatically generated and managed by: `gh actions-pin --write <workflow-path>`
-dependencies:
-  - github.com/actions/attest-build-provenance/predicate@36fa7d009e22618ca7cd599486979b8150596c74:sha1-36fa7d009e22618ca7cd599486979b8150596c74
-  - github.com/actions/attest-build-provenance@v1:sha1-ef244123eb79f2f7a7e75d99086184180e6d0018
-  - github.com/actions/attest@67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d:sha1-67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d
-  - github.com/actions/checkout@v6:sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd
-  - github.com/actions/setup-go@v5:sha1-40f1582b2485089dde7abd97c1529aa768e1baff
-  - github.com/cli/gh-extension-precompile@v2:sha1-9e2237c30f869ad3bcaed6a4be2cd43564dd421b

.github/workflows/sync-early-access-release.yml

@@ -24,7 +24,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Publish early access release
         env:
           SOURCE_TOKEN: ${{ github.token }}
@@ -33,7 +33,3 @@ jobs:
           TARGET_REPOSITORY: github-early-access/actions-locked-dependencies
           RELEASE_TAG: ${{ inputs.tag }}
         run: script/sync-early-access-release "$RELEASE_TAG"
-
-# Automatically generated and managed by: `gh actions-pin --write <workflow-path>`
-dependencies:
-  - github.com/actions/checkout@v6:sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/test.yml

@@ -5,18 +5,18 @@ on:
   push:
     branches:
       - main
+  permissions:
+    id-token: write # for setup-goproxy
+    contents: read
 
 jobs:
   go-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - name: OIDC Setup for goproxy
+        uses: github/setup-goproxy@5e60e1074d42316dfe2949ebf9a92bf77b24645b # v1.1.0
+      - uses: actions/checkout@v5.0.1
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
       - run: go test ./...
-
-# Automatically generated and managed by: `gh actions-pin --write <workflow-path>`
-dependencies:
-  - github.com/actions/checkout@v5:sha1-93cb6efe18208431cddfb8368fd83d5badbf9bfd
-  - github.com/actions/setup-go@v6:sha1-4a3601121dd01d1626a1e23e37211e3254c1c06c

.gitignore

@@ -1,2 +1,5 @@
 /gh-actions-pin
 /gh-actions-pin.exe
+
+# VHS demo recordings
+/demo/vhs/out/

AGENTS.md

@@ -0,0 +1,35 @@
+# Agent instructions
+
+## Code style
+
+Write Go that follows the [Google Go Style Guide](https://google.github.io/styleguide/go/guide) and lines up with [cli/cli](https://github.com/cli/cli) conventions. Keep it readable and simple.
+
+### Comments
+
+Doc comments earn their keep by saying something the code doesn't. Skip:
+
+- Restating the signature ("Foo does foo").
+- Meta-commentary about what the package _isn't_ ("intentionally pure", "no HTTP, no filesystem"). If it's true, the imports show it.
+- Stability sermons on every type. One short note in the package doc is enough.
+- Decorative em-dashes, hedging, or apologetic phrasing.
+
+Keep:
+
+- Why a non-obvious choice was made.
+- Invariants the type or function relies on.
+- Pointers to related code when the link isn't obvious from names.
+
+When in doubt, fewer words. If a comment reads like marketing or a victory lap, delete it.
+
+### Naming and shape
+
+- Prefer short, lowercase package names. No underscores.
+- Exported identifiers get a doc comment that starts with the identifier name.
+- Errors are values; wrap with `fmt.Errorf("...: %w", err)` and expose sentinels with `errors.Is`.
+- Don't pre-declare `var foo Type` then assign — declare at first use.
+
+### Tests
+
+- Table-driven by default; subtests named with what they assert, not how.
+- One assertion per logical claim; multiple `assert.X` calls beat one giant struct compare.
+- Don't golden-snapshot what you can assert structurally.