Add a sample workflow that verifies the lockfile in CI (#233)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

.github/workflows/actions.lock

@@ -12,6 +12,8 @@ workflows:
     '.github/workflows/test.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/setup-go@v7.0.0'
+    '.github/workflows/verify-lockfile.yml':
+        - 'actions/checkout@v7.0.1'
 dependencies:
     'actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32':
         ref: 'v4.1.0'

.github/workflows/verify-lockfile.yml

@@ -0,0 +1,38 @@
+# Fails when .github/workflows/actions.lock is out of sync with the
+# workflows or a locked pin no longer verifies upstream. Copy this file
+# into your repository's .github/workflows/ and run `gh actions-lock` once
+# to add it to your lockfile.
+#
+# --verify is read-only and calls the GitHub API to check every pin. The
+# job's GITHUB_TOKEN can read public actions and this repository; if your
+# workflows use actions from other private or internal repositories, pass
+# a token that can read them instead. --verify-local works offline but only
+# checks lockfile coverage, not that the pins are trustworthy.
+#
+# Exit codes: 0 valid, 1 findings to fix, 2 the check itself failed.
+
+name: verify-lockfile
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  # Catches upstream changes, like a re-pointed tag, between pull requests.
+  schedule:
+    - cron: '17 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - run: gh extension install github/gh-actions-lock --pin v0.2.0
+      - run: gh actions-lock --verify

README.md

@@ -60,6 +60,9 @@ To check without writing anything, for example in CI, run:
 gh actions-lock --verify
 ```
 
+For a ready-to-copy CI job that runs this on pull requests, see
+[`.github/workflows/verify-lockfile.yml`](.github/workflows/verify-lockfile.yml).
+
 If the GitHub API is unreachable or rate-limited, `--verify` retries for up to
 about 2 minutes in CI (a few seconds elsewhere), then fails (exit 1) with the pins it couldn't verify. Their
 `--json` findings carry `"retryable": true`; re-run the check once the API is