Problem

Migrating ./local-action to $/local-action changes which code runs when a preceding actions/checkout step selects a different repository or ref. The local path reads the checked-out workspace, while $/ resolves at the running commit.

This also affects nested references: a workflow can check out a different repository or ref and call an existing $/outer whose definition still uses ./inner. A file-local check misses that migration.

Fix

Reject the migration before writing any files when a preceding checkout has a non-empty ref other than ${{ github.sha }}, or a non-empty repository other than ${{ github.repository }}. Literal repository names and other repository expressions are conservatively rejected because their runtime repository identity cannot be established. The error identifies the action being migrated and the checkout input, value, file, and line, and points to --no-migrate-local-actions to preserve local references.

• Follow checkout state through nested ./… and $/… composite calls and back to subsequent caller steps. Keep jobs independent.
• Check all workflow callers before changing shared composite definitions, including callers outside a scoped run. Only references in files being migrated can trigger the checkout rejection.
• Keep earlier repository/ref overrides blocking even if a later checkout resets the workspace, since that later step may be conditional.
• Reuse the existing YAML and repository-boundary helpers. Cache traversal results by checkout context, reject composite cycles, and document the guard in the README.

The guard covers explicit checkout steps in workflows and in-repo composite actions; it does not analyze workspace changes through scripts or remote actions. Workflows retaining ./… references still cannot be onboarded to the lockfile.

Fixes #112.

Tests

• Confirmed the direct checkout-ref, cross-file, and repository-override regression tests fail before their fixes.
• Unit tests cover repository and ref classification, ordering, job boundaries, nested and repeated composite calls, conditional calls, YAML aliases, symlinks, scoped validation, and cycles. Command tests verify that rejection leaves workflows, action definitions, and the lockfile untouched, without resolving dependencies, in terminal, JSON, and scoped runs.
• make test (including the race-enabled Go suite), make build fmt-check vet, and all 34 make test-stub scenarios passed.
• Compiled-CLI smoke tests for repository override → $/outer → ./inner exited 2, reported the checkout source, and left every file unchanged in full, JSON, and scoped runs.