[0.1.7-rc1] --no-migrate-local-actions removes action references from lock file

[jessehouwing]

In a repo that relies on ./ references for which I haven't figured out yet how to replace them, I run

azdo-marketplace  gh actions-lock --rescan --no-migrate-local-actions
  ! LOCAL-ACTION .github\workflows\release-test-github-actions.yml
    workflow uses local path actions which are not supported; remove local path actions to continue using the lockfile
✗ 1 of 13 workflows failed: 1 local-action

After the run the lock file is overwritten and for .github\workflows\release-test-github-actions.yml all action refs are removed:

- '.github/workflows/release-test-github-actions.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.0.0'
-        - 'azure/login@v3.0.2'
+ '.github/workflows/release-test-github-actions.yml': []

And the workflow fails.

When I run without --no-migrate-local-actions the removed refs are restored:

 '.github/workflows/release-test-github-actions.yml':
        - 'actions/checkout@v7.0.1'
        - 'actions/setup-node@v7.0.0'
        - 'azure/login@v3.0.2'

And after manually replacing $/->./ the workflow runs again as expected.

[jessehouwing]

Attempting to re-pin a just-dependabotted workflow afterwards yields:

✗ 1 action requires investigation — do not auto-pin
    jessehouwing/azdo-marketplace@main
      └─ .github\workflows\release.yml
  ! REF-CHANGED jessehouwing/actions-dependency-submission@v1.0.17
    workflow uses ref "v1.0.17" but lockfile pins "v1.0.16"
    see: docs
  ! STALE jessehouwing/actions-dependency-submission@v1.0.16
    lockfile pins jessehouwing/actions-dependency-submission@v1.0.16 but no uses: in this workflow references it
    see: docs
  ! LOCAL-ACTION .github\workflows\release-test-github-actions.yml
    workflow uses local path actions which are not supported; remove local path actions to continue using the lockfile
  ! REF-CHANGED azure/login@v3.0.2
    workflow uses ref "v3.0.2" but lockfile pins "v3.0.1"
    see: docs
  ! STALE azure/login@v3.0.1
    lockfile pins azure/login@v3.0.1 but no uses: in this workflow references it
    see: docs
  ! REF-CHANGED github/codeql-action@v4.37.9
    workflow uses ref "v4.37.9" but lockfile pins "v4.37.8"
    see: docs
  ! STALE github/codeql-action@v4.37.8
    lockfile pins github/codeql-action@v4.37.8 but no uses: in this workflow references it
    see: docs
✗ 4 of 13 workflows failed: 3 ref-changed, 1 local-action, 3 stale

It's interesting how both the ref-changed shows up in the logs as well as the stale. These are both triggering on the same "issue" but surface different potential causes.

I think they should simply fix the workflow and the lock file especially when I pass --rescan.

I ended up deleting the lock file and regenerating it again. I'm not going to manually edit the lock file in this case... Maybe a --wizard option which asks me how to deal with these issues 1-by-1 would be better?