gha: bump for latest scitools/workflows

Author: bjlittle

.github/workflows/ci-locks.yml

@@ -16,7 +16,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.05.0
-    secrets: inherit
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@1f2141422a63321a32575ddd186e53acff12550c
+    secrets:
+      AUTH_APP_ID: ${{ secrets.AUTH_APP_ID }}
+      AUTH_APP_PRIVATE_KEY: ${{ secrets.AUTH_APP_PRIVATE_KEY }}

.github/workflows/ci-manifest.yml

@@ -22,7 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.05.0
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@1f2141422a63321a32575ddd186e53acff12550c

.github/workflows/ci-template-check.yml

@@ -8,9 +8,13 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.05.0
-    secrets: inherit
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@1f2141422a63321a32575ddd186e53acff12550c
+    secrets:
+      AUTH_APP_ID: ${{ secrets.AUTH_APP_ID }}
+      AUTH_APP_PRIVATE_KEY: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
     with:
       pr_number: ${{ github.event.pull_request.number }}