@@ -1773,3 +1773,28 @@ jobs:
 	_, stderr, err = runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", path)
 	require.NoError(t, err, stderr)
 }
+
+// TestVerifyLocalAcceptsRecordedTagWithAt: a composite pins its child by full
+// SHA, and the child's entry records the tag found for it, which contains @
+// (as actions/attest-build-provenance's predicate@2.0.0 does).
+func TestVerifyLocalAcceptsRecordedTagWithAt(t *testing.T) {
+	child := "864457a58d4733d7f1574bd8821fa24e02cf7538"
+	path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/attest-build-provenance@v3.0.0
+`)
+	lock := "version: '" + parserlock.Version + "'\ndependencies:\n" +
+		"  'actions/attest-build-provenance@v3.0.0':\n    ref: 'v3.0.0'\n    commit: 'sha1-" + strings.Repeat("e", 40) + "'\n    owner_id: 1\n    repo_id: 1\n" +
+		"    uses:\n      - 'actions/attest-build-provenance@" + child + "'\n" +
+		"  'actions/attest-build-provenance@" + child + "':\n    ref: 'predicate@2.0.0'\n    commit: 'sha1-" + child + "'\n    owner_id: 1\n    repo_id: 1\n" +
+		"workflows:\n  '.github/workflows/workflow.yml':\n    - 'actions/attest-build-provenance@v3.0.0'\n"
+	require.NoError(t, os.WriteFile(filepath.Join(".github", "workflows", "actions.lock"), []byte(lock), 0o600))
+
+	_, stderr, err := runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", path)
+	require.NoError(t, err, stderr)
+}
@@ -72,8 +72,7 @@ func fullSHAShaped(s string) bool {
 }
 
 // AcceptedRefName reports whether name is a ref name the Actions backend
-// accepts: a valid ref name that isn't shaped like `git describe` output and
-// has no @, which the backend's `uses:` grammar rejects.
+// accepts: a valid ref name that isn't shaped like `git describe` output.
 func AcceptedRefName(name string) bool {
-	return ValidRefName(name) && !describeSuffix.MatchString(name) && !strings.Contains(name, "@")
+	return ValidRefName(name) && !describeSuffix.MatchString(name)
 }
@@ -35,7 +35,7 @@ func TestAcceptedRefName(t *testing.T) {
 		{"v1-G1234", true}, // uppercase G
 		{"v1-g1234-rc", true},
 		{"main~1", false},
-		{"rel@1", false},
+		{"predicate@2.0.0", true},
 	}
 	for _, tt := range tests {
 		assert.Equal(t, tt.want, AcceptedRefName(tt.name), tt.name)
 
@@ -1092,6 +1092,11 @@ func TestLoadStateCanonicalizesFullSHAs(t *testing.T) {
 		require.ErrorIs(t, err, ErrCorruptLockfile)
 		assert.ErrorContains(t, err, "spell one full SHA in different cases")
 	})
+	t.Run("keeps a recorded tag containing @", func(t *testing.T) {
+		store, err := load(t, "o/comp@v1", entry("o/comp@v1", "v1", upper, "o/child@"+child), entry("o/child@"+child, "predicate@2.0.0", child, ""))
+		require.NoError(t, err)
+		assert.Equal(t, "predicate@2.0.0", store.File().Dependencies["o/child@"+strings.ToLower(child)].Ref)
+	})
 	t.Run("rejects a ref containing @", func(t *testing.T) {
 		_, err := load(t, "o/comp@rel@1", entry("o/comp@rel@1", "rel@1", lower, ""))
 		require.ErrorIs(t, err, ErrCorruptLockfile)
 
@@ -384,7 +384,9 @@ func (r *Resolver) ReverseLookup(ctx context.Context, deps []dep.Dependency) (ma
 				newRef = branch
 			}
 		}
-		if newRef == "" || newRef == d.Ref {
+		// An entry may record a ref containing @, but `uses:` can't name
+		// one, so such a use keeps its SHA.
+		if newRef == "" || newRef == d.Ref || strings.Contains(newRef, "@") {
 			continue
 		}
 		rewrites[d.NWO+"@"+d.Ref] = d.NWO + "@" + newRef
 
@@ -2,6 +2,7 @@ package resolve
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	"github.com/github/gh-actions-lock/internal/dep"
@@ -162,3 +163,24 @@ func TestReverseLookup_NoRewriteWhenRefUnchanged(t *testing.T) {
 		t.Fatalf("expected v1, got %q", got)
 	}
 }
+
+// TestReverseLookup_KeepsSHAUseForTagWithAt: a tag such as predicate@2.0.0
+// can be recorded as an entry's ref, but `uses:` can't name it.
+func TestReverseLookup_KeepsSHAUseForTagWithAt(t *testing.T) {
+	sha := strings.Repeat("a", 40)
+	reg := &httpmock.Registry{}
+	httpmock.NoTagsNamed(reg, "actions", "attest")
+	reg.Register(httpmock.REST("GET", `repos/actions/attest/tags`), httpmock.JSONResponse(httpmock.TagListResponse("predicate@2.0.0", sha)))
+	reg.Register(httpmock.REST("GET", `repos/actions/attest/branches`), httpmock.JSONResponse(httpmock.BranchListResponse("main", sha)))
+	r, err := New("github.com", pinpool.New(2, nil), WithTransport(reg))
+	require.NoError(t, err)
+	deps := []dep.Dependency{{NWO: "actions/attest", Ref: sha, SHA: sha, HashAlgo: "sha1"}}
+
+	rewrites, issues, err := r.ReverseLookup(context.Background(), deps)
+
+	require.NoError(t, err)
+	assert.Empty(t, issues)
+	assert.Empty(t, rewrites)
+	assert.Equal(t, sha, deps[0].Ref)
+	assert.Equal(t, "predicate@2.0.0", deps[0].Tag)
+}
Original file line number	Diff line number	Diff line change
`@@ -72,8 +72,7 @@ func fullSHAShaped(s string) bool {`
`72`	`72`	`}`
`73`	`73`
`74`	`74`	`// AcceptedRefName reports whether name is a ref name the Actions backend`
`75`		-// accepts: a valid ref name that isn't shaped like `git describe` output and
`76`		-// has no @, which the backend's `uses:` grammar rejects.
	`75`	+// accepts: a valid ref name that isn't shaped like `git describe` output.
`77`	`76`	`func AcceptedRefName(name string) bool {`
`78`		`- return ValidRefName(name) && !describeSuffix.MatchString(name) && !strings.Contains(name, "@")`
	`77`	`+ return ValidRefName(name) && !describeSuffix.MatchString(name)`
`79`	`78`	`}`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ func TestAcceptedRefName(t *testing.T) {`
`35`	`35`	`{"v1-G1234", true}, // uppercase G`
`36`	`36`	`{"v1-g1234-rc", true},`
`37`	`37`	`{"main~1", false},`
`38`		`- {"rel@1", false},`
	`38`	`+ {"predicate@2.0.0", true},`
`39`	`39`	`}`
`40`	`40`	`for _, tt := range tests {`
`41`	`41`	`assert.Equal(t, tt.want, AcceptedRefName(tt.name), tt.name)`
Original file line number	Diff line number	Diff line change
`@@ -384,7 +384,9 @@ func (r *Resolver) ReverseLookup(ctx context.Context, deps []dep.Dependency) (ma`
`384`	`384`	`newRef = branch`
`385`	`385`	`}`
`386`	`386`	`}`
`387`		`- if newRef == "" \|\| newRef == d.Ref {`
	`387`	+ // An entry may record a ref containing @, but `uses:` can't name
	`388`	`+ // one, so such a use keeps its SHA.`
	`389`	`+ if newRef == "" \|\| newRef == d.Ref \|\| strings.Contains(newRef, "@") {`
`388`	`390`	`continue`
`389`	`391`	`}`
`390`	`392`	`rewrites[d.NWO+"@"+d.Ref] = d.NWO + "@" + newRef`