Resolve dependencies live on every run

README.md

@@ -35,9 +35,10 @@ After the initial run to onboard workflows, you will need to run `gh actions-loc
 
 A full-directory run (`gh actions-lock` with no path arguments) also prunes lockfile entries for workflows that have been deleted from `.github/workflows/`, dropping any dependencies left orphaned by the removal. Scoped runs that name specific workflows never prune out-of-scope entries.
 
-Pins to branches or partial versions (e.g. `main`, `v4`) are trusted from the
-lockfile and not re-resolved on a normal run. To bump them to the current
-upstream commit, run:
+Normal networked runs live-resolve the dependency closure for the workflows in
+scope. If a branch or partial version (e.g. `main`, `v4`) has moved, the command
+reports the movement but retains the recorded commit. To permit advancing those
+pins to the current upstream commit, run:
 
 ```bash
 gh actions-lock --relock

cmd/gh-actions-lock/check_json_golden_test.go

@@ -40,6 +40,7 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 		checkoutSHA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
 		setupGoSHA  = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
 		cacheSHA    = "cccccccccccccccccccccccccccccccccccccccc"
+		staleSHA    = "dddddddddddddddddddddddddddddddddddddddd"
 		helperSHA   = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
 	)
 
@@ -55,9 +56,7 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 		"    - uses: actions/cache@v4\n" +
 		"    - uses: helper/only-transitive@v1\n"
 
-	// Direct refs from the workflow: checkout@v6, setup-go@v6, cache@v3.
-	// The resolver batches them into a single GraphQL request keyed by
-	// owner/name pairs (a0/a1/a2).
+	// Current workflow roots are resolved first.
 	reg.Register(
 		httpmock.GraphQLForRepo("actions", "checkout"),
 		httpmock.JSONResponse(map[string]any{
@@ -68,10 +67,7 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 			},
 		}),
 	)
-
-	// Transitive batch discovered from the setup-go composite: cache@v4
-	// (same NWO as a direct workflow ref) and helper/only-transitive@v1
-	// (transitive-only, gives us a populated required_by[] in the JSON).
+	// Path-aware recursive discovery resolves the composite's children.
 	reg.Register(
 		httpmock.GraphQLForRepo("actions", "cache"),
 		httpmock.JSONResponse(map[string]any{
@@ -81,6 +77,15 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 			},
 		}),
 	)
+	// Recorded-only refs are validated without recursive discovery.
+	reg.Register(
+		httpmock.GraphQLForRepo("old", "dead"),
+		httpmock.JSONResponse(map[string]any{
+			"data": map[string]any{
+				"a0": testRepoResponse("old/dead", staleSHA, nodeActionYAML),
+			},
+		}),
+	)
 
 	// Resolve the fixture path against the package directory BEFORE
 	// chdir'ing into the tempdir — UPDATE_GOLDEN rewrites the source
@@ -94,7 +99,7 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 	stdout, _, err := runCommandWithHTTP(t, reg,
 		// The fixture's lockfile addresses the workflow as
 		// .github/workflows/ci.yml, so we run check on that exact path.
-		"--rescan", "--no-fix", "--json=valid,findings,workflows,dependencies",
+		"--no-fix", "--json=valid,findings,workflows,dependencies",
 		".github/workflows/ci.yml",
 	)
 	// We expect findings (ref-changed + stale), so the command exits