Repository navigation
Check mutable-ref pins against ref history under --verify - #156
Merged
Merged
Conversation
This was referenced Oct 11, 2026
nodeselector
marked this pull request as ready for review
October 11, 2026 22:40
There was a problem hiding this comment.
🟢 Approval recommended
The implementation consistently handles GraphQL and REST paths with comprehensive command-level coverage.
0 open findings
What changed in this PR
Extends --verify to validate mutable-ref pins against current upstream history while preserving case-sensitive refs.
Changes:
- Resolves mutable-ref heads and verifies locked commit ancestry.
- Reports deleted refs with tailored remediation and terminal output.
- Adds GraphQL/REST and command-level coverage.
| File | Description |
|---|---|
README.md |
Documents verification behavior. |
internal/pipeline/run.go |
Passes verify mode into parity checks. |
internal/pipeline/parity.go |
Validates mutable-ref existence and ancestry. |
internal/pipeline/checks/finding.go |
Expands missing-ref semantics. |
internal/ghapi/repos.go |
Supports REST-only comparisons. |
internal/ghapi/graphql_parity.go |
Resolves mutable-ref heads. |
cmd/gh-actions-lock/run.go |
Wires and documents verify mode. |
cmd/gh-actions-lock/parity_test.go |
Tests ancestry, deletion, and ref casing. |
cmd/gh-actions-lock/format/terminal.go |
Tailors missing-ref presentation. |
cmd/gh-actions-lock/command_test.go |
Updates parity response fixtures. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
nodeselector
force-pushed
the
nodeselector-prerc-5-verify-ref-history
branch
from
October 11, 2026 22:53
0ec8bfb to
d06f9c0
Compare
nodeselector
force-pushed
the
nodeselector-prerc-4-repo-replaced
branch
2 times, most recently
from
October 11, 2026 23:20
59ce200 to
e53095c
Compare
Commits from a fork network are reachable under the upstream repo name, so a hand-edited actions.lock can lock a branch or partial-version ref to a commit that was never in that ref's history. Since #145 nothing caught this on --verify. --verify now resolves the ref head inside the batched parity query (or REST under the Dependabot proxy). When the head differs from the locked commit, one Compare call decides: not an ancestor is unreachable-pin, inconclusive is a warning (exit 2 under the proxy). Plain runs make no extra calls.
The runner rejects a pin whose ref doesn't resolve, so a missing branch or partial-version ref is unreachable-pin, not a pass. A failed lookup stays on the inconclusive path.
A locked branch or partial-version ref that no longer exists read as "Pinned commit not in upstream history" with release and hardening links, which describes an impostor commit. It now reads "Ref no longer exists" with only the remediation, and omits doc_url in JSON. The category stays unreachable-pin.
nodeselector
changed the base branch from
nodeselector-prerc-4-repo-replaced
to
main
October 11, 2026 23:23
nodeselector
force-pushed
the
nodeselector-prerc-5-verify-ref-history
branch
from
October 11, 2026 23:23
d06f9c0 to
3b7dcb1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--verifynow rejects a locked mutable ref that the runner would reject: one that no longer exists, or whose recorded commit isn't in the ref's history. Refs stay case-sensitive, because the runner treats them that way.Part 5 of 6 (#152 → #157). Previous: #155 Next: #157