{{ message }}
Repository navigation
Keep lockfiles that record a tag containing @ loadable - #217
Merged
Merged
Conversation
An entry may record a tag such as predicate@2.0.0, which the Actions backend accepts as an entry ref, so loading a lockfile that records one must keep working. Only a `uses:` can't name it: reverse lookup now keeps such a use's SHA instead of rewriting it to the tag. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
nodeselector
force-pushed
the
nodeselector-transitive-lock-graphs-f92
branch
from
October 21, 2026 04:29
2fbca95 to
5551e74
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot stopped reviewing on behalf of
nodeselector due to an error
October 21, 2026 05:11
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open issue
What changed in this PR
Updates reverse lookup and lockfile verification to support recording tags that contain @ (e.g., predicate@2.0.0) while ensuring workflow uses: references remain valid.
Changes:
- Prevent reverse-lookup rewrites to tag/branch names containing
@, keeping SHA-baseduses:intact. - Allow
@in recorded ref/tag metadata and adjust validation accordingly. - Add tests covering recorded tags containing
@across resolver, lockfile loading, and--verify-local.
Review effort: Lite
Comment on lines
74
to
78
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@(for examplepredicate@2.0.0, which a composite's SHA-pinned child can resolve to); only auses:ref, and so a lockfile key, can't contain@.uses:on the SHA instead of rewriting it to the tag.