v0.1.4

Reusable workflows are now checked and locked.

Reusable workflow calls are checked against their workflow (#6)

loopt lint compares every jobs.<id>.uses: call with the called workflow's on.workflow_call declaration:

• preloop/reusable-unknown-input, preloop/reusable-missing-input, preloop/reusable-input-type: undeclared inputs, missing required inputs, and literal values of the wrong type
• preloop/reusable-unknown-secret, preloop/reusable-missing-secret: secrets that don't match the declaration (skipped for secrets: inherit)
• preloop/reusable-unknown-output: needs.<call>.outputs.<name> that the called workflow doesn't declare
• preloop/reusable-not-callable, preloop/reusable-callee-missing: local workflows without a workflow_call trigger, or missing files

Local workflows (./ and $/) are read from the repo. Remote workflows are fetched at their ref with loopt lint --online; without it, they're skipped.

loopt lock pins reusable workflows (#7)

• Reusable calls are pinned to a full commit SHA with owner_id/repo_id. The actions inside each called workflow, and any reusable workflows it calls, are pinned too.
• The pins live in .github/workflows/reusable.lock. GitHub's actions.lock format can't record reusable workflows, so this keeps actions.lock valid for gh actions-lock and the hosted runner.
• loopt lock --verify detects moved refs. --verify-local requires an entry for every remote call; run loopt lock once after upgrading.
• Also reads v0.0.3 actions.lock files written by current gh actions-lock.