@@ -61,11 +61,22 @@ owner/repo@<sha>`), must have its commit in that ref's history, so a fork
 commit can't pass as upstream. Tags can move: the Actions backend accepts an
 exact tag that moved ahead of the commit, so runs allow it and `--verify` only
 warns. A lockfile entry whose `ref` the Actions backend resolver would reject
-fails the run (exit 2), naming the entry and its line: it must be a short tag
-or branch name the backend accepts, never a SHA, a `refs/` name, revision
-syntax such as `main~1`, or a `git describe` name, and it must equal the
-`uses:` ref unless that is a full SHA. A `uses:` ref that is not such a tag or
-branch, such as `pull/1/head` or `main~1`, is never locked.
+fails the run (exit 2), naming the first such entry in the file and its line:
+it must be a short tag or branch name the backend accepts, never a SHA, a
+`refs/` name, revision syntax such as `main~1`, or a `git describe` name, and
+it must equal the `uses:` ref unless that is a full SHA. A `uses:` ref that is
+not such a tag or branch, such as `pull/1/head` or `main~1`, is never locked.
+
+One exception loads instead: an entry keyed by a full SHA whose `ref` is that
+same SHA. The Actions backend still rejects it, so `--verify`, `--no-fix` and
+`--verify-local` report it as a `not-pinned` error (exit 1) and write nothing,
+wherever it sits: in a scanned workflow, in a workflow the run didn't scan or
+that was deleted, under a composite, or used by nothing. A plain run or
+`--relock` records the tag at that commit, else a branch containing it, keeps
+the full-SHA `uses:`, and drops the entry if nothing uses it; a commit no tag
+or branch contains still fails the run and nothing is written. A run given
+workflow paths leaves another workflow's such entry as it is, warns about it
+(exit 0), and doesn't report every workflow valid.
 `--verify-local` runs
 offline, never writes, and only checks that every ref has a lockfile entry,
 not that the entries are trustworthy; use `--verify` in CI for that.
 
@@ -58,3 +58,12 @@ and currently
 [accepts only lockfile schema `v0.0.2`](https://github.com/dependabot/dependabot-core/blob/main/github_actions/lib/dependabot/github_actions/constants.rb).
 Add schema support there before this CLI emits a new version. Unrelated releases
 do not need a Dependabot bump.
+
+The findings JSON fields can stay the same while behavior changes, which still
+needs this decision. Unreleased changes of that kind:
+
+- A lockfile entry keyed by a full SHA whose `ref` is that same SHA no longer
+  fails loading with exit 2. Read-only modes report it as a `not-pinned` error
+  and exit 1; a fix run re-records its tag or branch and exits 0, or fails
+  when no tag or branch contains the commit; a run given workflow paths warns
+  about another workflow's such entry and exits 0.
@@ -263,6 +263,28 @@ func parityOK(req *http.Request) (*http.Response, error) {
 	return httpmock.JSONResponse(map[string]any{"data": data})(req)
 }
 
+// parityOKWithIDs answers like parityOK, with each repository's databaseId
+// taken from ids (by repository name), as the API returns it; a repair
+// candidate's identity proof needs it.
+func parityOKWithIDs(ids map[string]int) httpmock.Responder {
+	return func(req *http.Request) (*http.Response, error) {
+		resp, err := parityOK(req)
+		if err != nil {
+			return nil, err
+		}
+		var body map[string]map[string]map[string]any
+		if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+			return nil, err
+		}
+		for _, repo := range body["data"] {
+			nwo, _ := repo["nameWithOwner"].(string)
+			_, name, _ := strings.Cut(nwo, "/")
+			repo["databaseId"] = ids[name]
+		}
+		return httpmock.JSONResponse(body)(req)
+	}
+}
+
 // parityFallback answers parity queries the test did not stub as intact,
 // since fresh pins fail closed on an inconclusive check.
 type parityFallback struct{ rt http.RoundTripper }
 
@@ -30,6 +30,13 @@ func PresentResults(out *ui.UI, report *checks.Report, valid bool, willRemediate
 		if f.Category == checks.FreshTag {
 			continue
 		}
+		if f.Severity == checks.SeverityError {
+			out.TermError("%s", f.Detail)
+			if f.Remediation != "" {
+				out.TermDetail("  %s", f.Remediation)
+			}
+			continue
+		}
 		out.TermWarn("%s", f.Detail)
 		if f.DocURL != "" {
 			out.TermDetail("see: %s", out.TermLink(f.DocURL, f.DocURL))
 
@@ -21,9 +21,12 @@ type lockRecovery func(lockPath string, parseErr error) (recovered bool, err err
 
 // newLockRecovery builds the recovery policy: always fail, naming the
 // problem. A bad entry usually means a hand edit, and deleting the lockfile
-// or fixing it automatically would lose the pins it records.
+// or fixing it automatically would lose the pins it records. When the
+// committed file is itself bad, version control can't help, so the
+// guidance also names the way to lock afresh.
 func newLockRecovery() lockRecovery {
 	return func(lockPath string, parseErr error) (bool, error) {
-		return false, fmt.Errorf("%w; if you edited %s by hand, restore it from version control", parseErr, filepath.Base(lockPath))
+		name := filepath.Base(lockPath)
+		return false, fmt.Errorf("%w; if you edited %s by hand, restore it from version control; otherwise move it aside and run `gh actions-lock` to lock your workflows again", parseErr, name)
 	}
 }
@@ -11,7 +11,8 @@ import (
 )
 
 // TestNewLockRecovery: a bad lockfile always fails, names the problem, points
-// at version control, and is never deleted.
+// at version control for a hand edit and at a fresh lock otherwise, since
+// a committed bad file can't be restored, and is never deleted.
 func TestNewLockRecovery(t *testing.T) {
 	p := filepath.Join(t.TempDir(), "actions.lock")
 	require.NoError(t, os.WriteFile(p, []byte("corrupt"), 0o600))
@@ -21,7 +22,7 @@ func TestNewLockRecovery(t *testing.T) {
 	require.Error(t, err)
 	assert.False(t, recovered)
 	assert.ErrorIs(t, err, parseErr)
-	assert.Equal(t, parseErr.Error()+"; if you edited actions.lock by hand, restore it from version control", err.Error())
+	assert.Equal(t, parseErr.Error()+"; if you edited actions.lock by hand, restore it from version control; otherwise move it aside and run `gh actions-lock` to lock your workflows again", err.Error())
 	assert.NotContains(t, err.Error(), "delete")
 	assert.FileExists(t, p)
 }
Original file line number	Diff line number	Diff line change
`@@ -21,9 +21,12 @@ type lockRecovery func(lockPath string, parseErr error) (recovered bool, err err`
`21`	`21`
`22`	`22`	`// newLockRecovery builds the recovery policy: always fail, naming the`
`23`	`23`	`// problem. A bad entry usually means a hand edit, and deleting the lockfile`
`24`		`-// or fixing it automatically would lose the pins it records.`
	`24`	`+// or fixing it automatically would lose the pins it records. When the`
	`25`	`+// committed file is itself bad, version control can't help, so the`
	`26`	`+// guidance also names the way to lock afresh.`
`25`	`27`	`func newLockRecovery() lockRecovery {`
`26`	`28`	`return func(lockPath string, parseErr error) (bool, error) {`
`27`		`- return false, fmt.Errorf("%w; if you edited %s by hand, restore it from version control", parseErr, filepath.Base(lockPath))`
	`29`	`+ name := filepath.Base(lockPath)`
	`30`	+ return false, fmt.Errorf("%w; if you edited %s by hand, restore it from version control; otherwise move it aside and run `gh actions-lock` to lock your workflows again", parseErr, name)
`28`	`31`	`}`
`29`	`32`	`}`