nodeselector · Jul 13, 2026 · Jul 10, 2026 · Jul 10, 2026 · Jul 10, 2026 · Jul 10, 2026
@@ -1,5 +1,5 @@
 name: Lint actions.lock
-description: Check that actions.lock is in sync with workflow files
+description: Check that actions.lock is in sync with workflows and every pin still resolves upstream
 
 inputs:
   extra-flags:

@@ -261,15 +261,15 @@ jobs:
 // Lockfile Forgery Detection Tests
 //
 // These tests verify that the ancestry check promotes ref-moved to
-// lockfile-forgery when the pinned SHA is not an ancestor of the live SHA.
+// unreachable-pin when the pinned SHA is not an ancestor of the live SHA.
 // This detects cases where someone manually injected a SHA into the lockfile
 // that was never part of the ref's legitimate history.
 // ==========================================================================
 
-// TestCheck_LockfileForgery_NotAncestor verifies that when the Compare API
+// TestCheck_UnreachablePin_NotAncestor verifies that when the Compare API
 // shows the pinned SHA is NOT an ancestor of the live SHA, the finding is
-// promoted from ref-moved to lockfile-forgery.
-func TestCheck_LockfileForgery_NotAncestor(t *testing.T) {
+// promoted from ref-moved to unreachable-pin.
+func TestCheck_UnreachablePin_NotAncestor(t *testing.T) {
 	reg := &httpmock.Registry{}
 	defer reg.Verify(t)
 
@@ -325,14 +325,14 @@ jobs:
 	for _, f := range payload.Findings {
 		categories[f.Category] = true
 	}
-	assert.True(t, categories["lockfile-forgery"], "should detect lockfile forgery: %+v", payload.Findings)
+	assert.True(t, categories["unreachable-pin"], "should detect lockfile forgery: %+v", payload.Findings)
 	assert.False(t, categories["ref-moved"], "should NOT have ref-moved (promoted to forgery): %+v", payload.Findings)
 }
 
-// TestCheck_LockfileForgery_LegitAncestor verifies that when the Compare API
+// TestCheck_UnreachablePin_LegitAncestor verifies that when the Compare API
 // confirms the pinned SHA IS an ancestor of the live SHA, the finding stays
 // as ref-moved (legitimate tag movement, not forgery).
-func TestCheck_LockfileForgery_LegitAncestor(t *testing.T) {
+func TestCheck_UnreachablePin_LegitAncestor(t *testing.T) {
 	reg := &httpmock.Registry{}
 	defer reg.Verify(t)
 
@@ -388,14 +388,14 @@ jobs:
 		categories[f.Category] = true
 	}
 	assert.True(t, categories["ref-moved"], "should keep as ref-moved for legit ancestor: %+v", payload.Findings)
-	assert.False(t, categories["lockfile-forgery"], "should NOT have lockfile-forgery: %+v", payload.Findings)
+	assert.False(t, categories["unreachable-pin"], "should NOT have unreachable-pin: %+v", payload.Findings)
 }
 
-// TestCheck_LockfileForgery_RateLimited verifies that when the ancestry
+// TestCheck_UnreachablePin_RateLimited verifies that when the ancestry
 // check is rate-limited, the finding surfaces as ancestry-unknown — not
 // ref-moved (which would imply a benign-but-known move) and not
-// lockfile-forgery (which requires an authoritative not-ancestor answer).
-func TestCheck_LockfileForgery_RateLimited(t *testing.T) {
+// unreachable-pin (which requires an authoritative not-ancestor answer).
+func TestCheck_UnreachablePin_RateLimited(t *testing.T) {
 	reg := &httpmock.Registry{}
 	defer reg.Verify(t)
 
@@ -446,7 +446,7 @@ jobs:
 		categories[f.Category] = true
 	}
 	assert.True(t, categories["ancestry-unknown"], "should classify as ancestry-unknown when rate limited: %+v", payload.Findings)
-	assert.False(t, categories["lockfile-forgery"], "should NOT have lockfile-forgery when rate limited: %+v", payload.Findings)
+	assert.False(t, categories["unreachable-pin"], "should NOT have unreachable-pin when rate limited: %+v", payload.Findings)
 	assert.False(t, categories["ref-moved"], "should NOT downgrade to ref-moved when rate limited: %+v", payload.Findings)
 	assert.False(t, categories["valid"], "rate-limited ancestry must not regress to CategoryValid: %+v", payload.Findings)
 

@@ -47,6 +47,135 @@ func PresentResults(out *ui.UI, report *checks.Report, valid bool, willRemediate
 	renderWarnings(out, report, willRemediate)
 }
 
+// PresentReadOnlyFailures renders error-level findings directly to the
+// terminal for read-only modes (--no-fix / --verify). Those modes return
+// before the fix-mode summary (renderPinSummary) runs, so the error block
+// that renderErrorFindings emits via the narration helpers is discarded
+// when the log sink is io.Discard. This uses the Term* family instead so
+// failures actually reach the operator.
+//
+// It reports whether any failing finding is auto-fixable (i.e. not an
+// investigation-only category) so the caller can decide whether the
+// "re-run to fix" hint is honest.
+func PresentReadOnlyFailures(out *ui.UI, report *checks.Report) (hasFixable bool) {
+	type depGroup struct {
+		findings  []checks.Finding
+		workflows []string
+		seenWF    map[string]bool
+	}
+	var order []string
+	groups := map[string]*depGroup{}
+	var failedCount, checked int
+
+	for i := range report.Workflows {
+		wr := &report.Workflows[i]
+		checked++
+		if wr.IsValid() {
+			continue
+		}
+		failedCount++
+		for _, f := range wr.Findings {
+			if f.IsValid() {
+				continue
+			}
+			key := f.DepKey()
+			if key == "" {
+				key = wr.Path
+			}
+			g, ok := groups[key]
+			if !ok {
+				g = &depGroup{seenWF: map[string]bool{}}
+				groups[key] = g
+				order = append(order, key)
+			}
+			g.findings = append(g.findings, f)
+			if wr.Path != "" && !g.seenWF[wr.Path] {
+				g.seenWF[wr.Path] = true
+				g.workflows = append(g.workflows, wr.Path)
+			}
+		}
+	}
+
+	if len(order) == 0 {
+		return false
+	}
+
+	out.TermBlank()
+	out.TermError("%d of %d %s failed verification",
+		failedCount, checked, ui.Pluralize(checked, "workflow", "workflows"))
+	for _, key := range order {
+		g := groups[key]
+		out.TermBlank()
+		for _, f := range g.findings {
+			if IsAutoFixable(f.Category) {
+				hasFixable = true
+			}
+			renderTermFindingDetail(out, f, key)
+		}
+		for _, wf := range g.workflows {
+			out.TermDetail("  ↳ %s", out.TermDim(wf))
+		}
+	}
+	return hasFixable
+}
+
+// renderTermFindingDetail is the Term* twin of renderFindingDetail: it
+// prints a single non-valid finding to the terminal (bypassing the
+// narration log) so read-only modes surface the same detail as fix mode.
+func renderTermFindingDetail(out *ui.UI, f checks.Finding, dep string) {
+	label := categoryLabel(f.Category)
+	icon := "!"
+	if IsAlertedCategory(f.Category) {
+		icon = "✗"
+	}
+	out.TermDetail("%s %s %s", icon, out.TermDim(label), dep)
+	out.TermDetail("  %s", f.Detail)
+	if f.Category == checks.UnreachablePin && f.Dependency != nil {
+		owner, repo := f.Dependency.OwnerRepo()
+		if owner != "" {
+			out.TermDetail("  ↳ %s", out.TermDim(fmt.Sprintf("https://github.com/%s/%s/releases", owner, repo)))
+		}
+	}
+	if IsAlertedCategory(f.Category) && f.Remediation != "" {
+		out.TermDetail("  %s %s", ui.IconWarning, f.Remediation)
+	}
+	if f.RecommendedTag != "" {
+		nwo := ""
+		if f.Dependency != nil {
+			nwo = f.Dependency.NWO
+		}
+		sha := f.RecommendedSHA
+		if len(sha) > 7 {
+			sha = sha[:7]
+		}
+		out.TermDetail("  ↳ Suggested pin: %s@%s (%s) — newest release currently on that branch",
+			nwo, f.RecommendedTag, sha)
+	}
+	if f.DocURL != "" {
+		out.TermDetail("  see: %s", out.TermDim(out.TermLink("how to fix this", f.DocURL)))
+	}
+}
+
+// categoryLabel returns a human-readable label for a finding category,
+// e.g. "unreachable-pin" -> "Unreachable pin". Falls back to a
+// hyphen-to-space title for unmapped categories so new slugs still read
+// cleanly.
+func categoryLabel(c checks.Category) string {
+	switch c {
+	case checks.NotPinned:
+		return "Not pinned"
+	case checks.RefChanged:
+		return "Ref changed"
+	case checks.MisleadingSHA:
+		return "Misleading SHA"
+	case checks.UnreachablePin:
+		return "Unreachable pin"
+	case checks.Stale:
+		return "Unused lockfile entry"
+	}
+	return strings.ReplaceAll(string(c), "-", " ")
+}
+
 // renderErrorFindings groups error-level findings by dependency and prints
 // per-dep detail lines followed by a category-count summary.
 func renderErrorFindings(out *ui.UI, report *checks.Report, failedCount, checked int, exclude map[checks.Category]bool) {
@@ -102,7 +231,7 @@ func renderErrorFindings(out *ui.UI, report *checks.Report, failedCount, checked
 
 	parts := []string{}
 	for _, cat := range []checks.Category{
-		checks.LockfileForgery,
+		checks.UnreachablePin,
 		checks.RefChanged, checks.NotPinned, checks.OnboardingRequired,
 		checks.LocalAction,
 		checks.Stale, checks.MisleadingSHA,
@@ -128,7 +257,7 @@ func renderFindingDetail(out *ui.UI, f checks.Finding, dep string) {
 	}
 	out.Detail("%s %s %s", icon, out.Dim(label), dep)
 	out.Detail("  %s", f.Detail)
-	if f.Category == checks.LockfileForgery && f.Dependency != nil {
+	if f.Category == checks.UnreachablePin && f.Dependency != nil {
 		owner, repo := f.Dependency.OwnerRepo()
 		if owner != "" {
 			out.Detail("  ↳ %s", out.Dim(fmt.Sprintf("https://github.com/%s/%s/releases", owner, repo)))
@@ -277,7 +406,21 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) {
 // remediator should not re-print it in non-interactive mode).
 func IsAlertedCategory(c checks.Category) bool {
 	switch c {
-	case checks.LockfileForgery, checks.MisleadingSHA, checks.OnboardingRequired:
+	case checks.UnreachablePin, checks.MisleadingSHA, checks.OnboardingRequired:
+		return true
+	}
+	return false
+}
+
+// IsAutoFixable reports whether a plain `gh actions-lock` run (no --no-fix)
+// re-pins the finding without operator intervention. Only structural drift
+// qualifies: a missing, changed, or orphaned lock entry. Integrity failures
+// (unreachable-pin, misleading-sha) need investigation or --accept-moved, and
+// local-path actions aren't supported at all — so none of those should
+// trigger the "Re-run without --no-fix to apply fixes" hint.
+func IsAutoFixable(c checks.Category) bool {
+	switch c {
+	case checks.NotPinned, checks.RefChanged, checks.Stale:
 		return true
 	}
 	return false