Pinning: repair SHA refs from existing lock metadata

cmd/gh-actions-lock/command_test.go

@@ -1056,7 +1056,11 @@ func TestCheckCommand_LoadErrorFailsFixMode(t *testing.T) {
 			args := append(tt.args, workflowPath)
 			_, stderr, err := runCommandWithHTTP(t, reg, args...)
 			require.Error(t, err)
-			assert.Contains(t, err.Error(), "parsing workflow YAML")
+			if tt.name == "migration enabled" {
+				assert.Contains(t, err.Error(), "parsing workflow YAML")
+			} else {
+				require.ErrorIs(t, err, errSilent)
+			}
 			assert.NotContains(t, stderr, "All 1 workflow valid")
 		})
 	}

cmd/gh-actions-lock/migrate_test.go

@@ -173,9 +173,7 @@ jobs:
 
 	t.Chdir(dir)
 
-	_, _, err := runCommandWithHTTP(t, reg,
-		".github/workflows/workflow.yml",
-	)
+	_, _, err := runCommandWithHTTP(t, reg)
 	require.NoError(t, err)
 
 	read := func(rel string) string {
@@ -267,3 +265,58 @@ jobs:
 		assert.NotContains(t, got, "$/", "opt-out means no migration to $/")
 	})
 }
+
+func TestNoMigrateLocalActions_PreservesExistingPins(t *testing.T) {
+	const workflowWithRemoteAction = `name: CI
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/foo
+      - uses: actions/checkout@v4
+`
+	const workflowWithOnlyLocalAction = `name: CI
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/foo
+`
+	const lock = `version: 'v0.0.2'
+dependencies:
+  'actions/checkout@v4':
+    ref: 'v4'
+    commit: 'sha1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+    owner_id: 1
+    repo_id: 1
+workflows:
+  '.github/workflows/ci.yml':
+    - 'actions/checkout@v4'
+`
+
+	for name, workflow := range map[string]string{
+		"remote and local actions": workflowWithRemoteAction,
+		"only local action":        workflowWithOnlyLocalAction,
+		"malformed workflow":       "name: [",
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			t.Chdir(dir)
+			workflowPath := filepath.Join(".github", "workflows", "ci.yml")
+			require.NoError(t, os.MkdirAll(filepath.Dir(workflowPath), 0o755))
+			require.NoError(t, os.WriteFile(workflowPath, []byte(workflow), 0o600))
+			lockPath := filepath.Join(".github", "workflows", "actions.lock")
+			require.NoError(t, os.WriteFile(lockPath, []byte(lock), 0o600))
+
+			transport := &requestCountingTransport{}
+			_, _, err := runCommandWithHTTP(t, transport, "--rescan", "--no-migrate-local-actions")
+			require.Error(t, err)
+			got, readErr := os.ReadFile(lockPath)
+			require.NoError(t, readErr)
+			assert.Equal(t, 2, strings.Count(string(got), "'actions/checkout@v4'"))
+			assert.NotContains(t, string(got), "'.github/workflows/ci.yml': []")
+		})
+	}
+}

cmd/gh-actions-lock/pin_summary.go

@@ -176,10 +176,9 @@ func renderCooldownFindings(console *ui.UI, report *checks.Report) {
 	}
 }
 
-// renderNarrowedEntries shows refs that were upgraded from mutable (main, v4)
-// to full semver (v6.0.2) on already-pinned workflows.
+// renderNarrowedEntries shows refs updated on already-pinned workflows.
 func renderNarrowedEntries(console *ui.UI, narrowed []pin.Entry) {
-	console.TermSuccess("Narrowed %d %s to full semver",
+	console.TermSuccess("Updated %d %s",
 		len(narrowed), ui.Pluralize(len(narrowed), "ref", "refs"))
 	for _, e := range narrowed {
 		console.TermDetail(" %s@%s → %s", e.NWO, e.AutoFixedRef, e.Ref)

cmd/gh-actions-lock/pin_summary_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/github/gh-actions-lock/internal/pipeline/checks"
 	"github.com/github/gh-actions-lock/internal/resolve"
 	"github.com/github/gh-actions-lock/internal/ui"
+	"github.com/stretchr/testify/assert"
 )
 
 // A workflow shared between two different actions must still be listed under
@@ -39,6 +40,23 @@ func TestRenderPinnedEntries_WorkflowSharedAcrossActions(t *testing.T) {
 	}
 }
 
+func TestRenderNarrowedEntries_BranchRepair(t *testing.T) {
+	var buf bytes.Buffer
+	console := ui.NewPlain(&buf)
+
+	renderNarrowedEntries(console, []pin.Entry{{
+		NWO:          "owner/action",
+		Ref:          "main",
+		AutoFixedRef: strings.Repeat("a", 40),
+	}})
+
+	out := buf.String()
+	assert.Contains(t, out, "Updated 1 ref")
+	assert.NotContains(t, out, "semver")
+	assert.Contains(t, out, "owner/action@aaaaaaaa")
+	assert.Contains(t, out, "→ main")
+}
+
 func TestReportHasUnfixableErrors_ClassifiesWorkflowNotPinned(t *testing.T) {
 	for _, tt := range []struct {
 		name        string

cmd/gh-actions-lock/run.go

@@ -380,6 +380,7 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 		NoNarrow:    opts.noNarrow,
 		AcceptMoved: opts.acceptMoved,
 		Relock:      opts.relock,
+		PartialScan: !fullScan,
 	})
 	endPlan()
 	if planErr != nil {

cmd/gh-actions-lock/selfrepository_test.go

@@ -97,3 +97,105 @@ jobs:
 	_, readErr = os.Stat(lockPath)
 	assert.ErrorIs(t, readErr, os.ErrNotExist)
 }
+
+func TestExistingSHARefRewritesSelfRepositoryAction(t *testing.T) {
+	const sha = "bcd2ba49218906704ab6c1aa796996da409d3eb1"
+	transport := &requestCountingTransport{}
+
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+	actionPath := filepath.Join(dir, ".github", "actions", "local", "action.yml")
+	require.NoError(t, os.MkdirAll(filepath.Dir(actionPath), 0o755))
+	require.NoError(t, os.WriteFile(actionPath, []byte(`name: Local
+runs:
+  using: composite
+  steps:
+    - uses: actions/create-github-app-token@`+sha+`
+`), 0o600))
+
+	workflowPath := filepath.Join(dir, ".github", "workflows", "ci.yml")
+	require.NoError(t, os.MkdirAll(filepath.Dir(workflowPath), 0o755))
+	workflow := []byte(`name: CI
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: $/.github/actions/local
+`)
+	require.NoError(t, os.WriteFile(workflowPath, workflow, 0o600))
+	require.NoError(t, os.WriteFile(filepath.Join(filepath.Dir(workflowPath), "other.yml"), []byte(`name: Other
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v3.2.0
+`), 0o600))
+	lockPath := filepath.Join(dir, ".github", "workflows", "actions.lock")
+	originalLock := []byte(`version: 'v0.0.2'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/create-github-app-token@` + sha + `'
+    '.github/workflows/other.yml':
+        - 'actions/create-github-app-token@v3.2.0'
+dependencies:
+    'actions/create-github-app-token@` + sha + `':
+        ref: 'v3.2.0'
+        commit: 'sha1-` + sha + `'
+        owner_id: 44036562
+        repo_id: 642580244
+        uses:
+            - 'actions/checkout@v4'
+    'actions/create-github-app-token@v3.2.0':
+        ref: 'v3.2.0'
+        commit: 'sha1-` + sha + `'
+        owner_id: 44036562
+        repo_id: 642580244
+        uses:
+            - 'actions/setup-go@v5'
+    'actions/checkout@v4':
+        ref: 'v4'
+        commit: 'sha1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/setup-go@v5':
+        ref: 'v5'
+        commit: 'sha1-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+        owner_id: 44036562
+        repo_id: 485264523
+`)
+	require.NoError(t, os.WriteFile(lockPath, originalLock, 0o600))
+	t.Chdir(dir)
+
+	_, _, err := runCommandWithHTTP(t, transport, "--no-narrow", filepath.Join(".github", "workflows", "ci.yml"))
+	require.NoError(t, err)
+	lockAfterNoNarrow, err := os.ReadFile(lockPath)
+	require.NoError(t, err)
+
+	_, _, err = runCommandWithHTTP(t, transport, filepath.Join(".github", "workflows", "ci.yml"))
+	require.ErrorContains(t, err, "partial workflow scan")
+	action, readErr := os.ReadFile(actionPath)
+	require.NoError(t, readErr)
+	assert.Contains(t, string(action), "uses: actions/create-github-app-token@"+sha)
+	lock, readErr := os.ReadFile(lockPath)
+	require.NoError(t, readErr)
+	assert.Equal(t, lockAfterNoNarrow, lock)
+
+	_, _, err = runCommandWithHTTP(t, transport)
+	require.NoError(t, err)
+	assert.Zero(t, transport.calls.Load())
+
+	action, err = os.ReadFile(actionPath)
+	require.NoError(t, err)
+	assert.Contains(t, string(action), "uses: actions/create-github-app-token@v3.2.0")
+
+	lock, err = os.ReadFile(lockPath)
+	require.NoError(t, err)
+	assert.Contains(t, string(lock), "'actions/create-github-app-token@v3.2.0'")
+	assert.Contains(t, string(lock), "'actions/checkout@v4'")
+	assert.Contains(t, string(lock), "'actions/setup-go@v5'")
+	assert.Contains(t, string(lock), "uses:\n            - 'actions/checkout@v4'")
+	assert.Contains(t, string(lock), "- 'actions/setup-go@v5'")
+	assert.NotContains(t, string(lock), "'actions/create-github-app-token@"+sha+"'")
+}

internal/dep/dependency.go

@@ -27,6 +27,8 @@ type Dependency struct {
 	Ref      string // resolved ref as given in uses:
 	SHA      string // full commit hash
 	HashAlgo string // "sha1" or "sha256"
+	// OriginalRef is the lockfile key ref before an in-memory rewrite.
+	OriginalRef string
 	// Tag is the discovered release/tag pointing at SHA, if any. Optional.
 	// Populated by the pin-time discovery pass; not read from `uses:`.
 	Tag string

internal/lockfile/state.go

@@ -406,14 +406,28 @@ func (s *State) Set(ctx context.Context, workflowKey string, deps []dep.Dependen
 				ref = d.Branch
 			}
 		}
-		if existing, ok := s.file.Dependencies[pinKey]; ok {
+		existing, ok := s.file.Dependencies[pinKey]
+		if ok {
 			if ref == "" {
 				ref = existing.Ref
 			}
 			for _, u := range existing.Uses {
 				usesSet[u] = true
 			}
 		}
+		oldRef := d.OriginalRef
+		if !isSHARef(d.Ref) && isSHARef(oldRef) {
+			shaPin := pin
+			shaPin.Ref = oldRef
+			if shaExisting, shaOK := s.file.Dependencies[shaPin.String()]; shaOK {
+				if !ok && ref == "" {
+					ref = shaExisting.Ref
+				}
+				for _, u := range shaExisting.Uses {
+					usesSet[u] = true
+				}
+			}
+		}
 		var uses []string
 		if len(usesSet) > 0 {
 			uses = make([]string, 0, len(usesSet))

internal/lockfile/state_test.go

@@ -111,6 +111,47 @@ func actionKeys[V any](m map[string]V) []string {
 	return keys
 }
 
+func TestState_DoesNotMergeImplicitSHAEdges(t *testing.T) {
+	dir := t.TempDir()
+	store, err := LoadState(dir, fakeMetadataResolver{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	const sha = "1111111111111111111111111111111111111111"
+	symbolic := dep.Dependency{NWO: "owner/action", Ref: "v1", SHA: sha, HashAlgo: "sha1"}
+	shaParent := dep.Dependency{NWO: "owner/action", Ref: sha, SHA: sha, HashAlgo: "sha1"}
+	child := dep.Dependency{
+		NWO: "actions/checkout", Ref: "v4",
+		SHA: "2222222222222222222222222222222222222222", HashAlgo: "sha1",
+	}
+	ctx := context.Background()
+	if err := store.Set(ctx, "symbolic.yml", []dep.Dependency{symbolic}, nil, map[string]bool{symbolic.Key(): true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.Set(ctx, "sha.yml", []dep.Dependency{shaParent, child},
+		map[string][]string{child.Key(): {shaParent.Key()}},
+		map[string]bool{shaParent.Key(): true}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := store.Set(ctx, "symbolic.yml", []dep.Dependency{symbolic}, nil, map[string]bool{symbolic.Key(): true}); err != nil {
+		t.Fatal(err)
+	}
+	store.PruneWorkflows(map[string]bool{"symbolic.yml": true})
+	if err := store.Save(); err != nil {
+		t.Fatal(err)
+	}
+
+	action := store.file.Dependencies["owner/action@v1"]
+	if len(action.Uses) != 0 {
+		t.Fatalf("symbolic dependency retained unrelated SHA edges: %v", action.Uses)
+	}
+	if _, ok := store.file.Dependencies[child.Key()]; ok {
+		t.Fatalf("stale child %q was not garbage-collected", child.Key())
+	}
+}
+
 // TestState_SetAcceptsEmptyBranch verifies that deps with no discovered
 // branch are accepted — the new schema makes ref optional.
 func TestState_SetAcceptsEmptyBranch(t *testing.T) {

internal/pin/commit.go

@@ -156,11 +156,12 @@ func groupPinnedByWorkflow(rec *Record) map[string][]dep.Dependency {
 		}
 		for _, wf := range e.Workflows {
 			result[wf] = append(result[wf], dep.Dependency{
-				NWO:    e.NWO,
-				Ref:    e.Ref,
-				SHA:    e.SHA,
-				Branch: e.OnBranch,
-				Tag:    e.Tag,
+				NWO:         e.NWO,
+				Ref:         e.Ref,
+				SHA:         e.SHA,
+				OriginalRef: e.AutoFixedRef,
+				Branch:      e.OnBranch,
+				Tag:         e.Tag,
 			})
 		}
 	}