Don't count about-to-be-pinned workflows as failed by nodeselector · Pull Request #86 · github/gh-actions-lock · GitHub
Skip to content

Don't count about-to-be-pinned workflows as failed - #86

Merged
nodeselector merged 4 commits into
mainfrom
nodeselector-issue-802-summary-miscount
Jul 24, 2026
Merged

nodeselector merged 4 commits into
mainfrom
nodeselector-issue-802-summary-miscount

Conversation

@nodeselector

@nodeselector nodeselector commented Jul 13, 2026 •

Copy link
Copy Markdown
Collaborator

What

Count only workflows that remain blocked after partial lockfile onboarding.

Why

Onboarding is atomic per workflow, not per repository. A mixed run can persist successful workflows while leaving a blocked workflow untouched, but the post-fix summary counted every pre-fix not-pinned finding as a failure.

That produced output such as 4 of 4 workflows failed after three workflows had been pinned successfully.

Resolves github/actions-dispatch#802.

How

  • Apply the same finding-exclusion predicate to workflow and category counts.
  • Exclude dependency-level not-pinned findings after remediation.
  • Keep fatal workflow load errors visible and in the nonzero-exit gate.
  • Mark dependency-inventory read errors as remediable because pinning can regenerate those entries.
  • Preserve per-workflow writes: successful workflows commit while blocked workflows remain untouched.

Alternatives considered

  • Treat every workflow-level not-pinned finding as fatal: rejected because dependency-inventory errors can be repaired during the same run.
  • Suppress every not-pinned finding after remediation: rejected because workflow parse failures must remain visible and fail the command.
  • Make onboarding repository-atomic: rejected because the intended behavior is atomicity per workflow.

Risk

Aspect Assessment
Blast radius Terminal summaries and error gating for fix-mode lockfile onboarding
Reversibility Easy rollback
Rollback plan Revert the four branch commits
Dependencies None

Testing

  • Full Go test suite with the race detector
  • Go vet and formatting checks
  • Command tests for malformed workflows with migration enabled and disabled
  • Renderer and gate tests for fatal load errors and repairable dependency errors
  • Live catalog regression proving three workflows persist while one blocked workflow is the only failure counted

Copilot AI review requested due to automatic review settings July 13, 2026 22:01
@nodeselector
nodeselector requested a review from a team as a code owner July 13, 2026 22:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Not ready to approve

The new “remediable-only” logic can incorrectly suppress real failures because NotPinned is also used for non-remediable workflow errors (e.g., load/deps errors), and the current exclusion logic can hide the only failure reason.

Pull request overview

Adjusts the terminal renderer’s failure summary so workflows that are about to be auto-pinned (dep-level not-pinned) don’t get reported as “failed” during a remediation run, avoiding misleading onboarding output.

Changes:

  • Adds isRemediableOnly to detect workflows that are only failing due to dep-level NotPinned when willRemediate is true.
  • Updates PresentResults to exclude remediable-only workflows from failedCount, and to conditionally suppress not-pinned in the error summary during remediation.
  • Adds a focused regression test covering onboarding-only output vs mixed failures vs read-only behavior.
File summaries
File Description
cmd/gh-actions-lock/format/terminal.go Refines “failed workflows” counting and error-summary rendering to treat about-to-be-pinned workflows as remediable (not failed).
cmd/gh-actions-lock/format/terminal_test.go Adds regression coverage for remediation vs read-only summary output around not-pinned.

Review details

  • Files reviewed: 2/2 changed files
  • Comments generated: 3
  • Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread cmd/gh-actions-lock/format/terminal.go Outdated
Comment thread cmd/gh-actions-lock/format/terminal.go Outdated
Comment thread cmd/gh-actions-lock/format/terminal_test.go Outdated
The pre-remediation summary computed its failed count by treating every
workflow where !IsValid() as a failure. A workflow whose only non-valid
finding is a dep-level NotPinned is exactly what the current run is about
to pin, so a plain onboarding run reported "N of N workflows failed:
N not-pinned" for work it was actively doing.

Exclude remediable-only workflows (willRemediate and every non-valid
finding is NotPinned) from the failed count, gate the error block on a
non-zero failed count, and drop not-pinned from the error parts when
remediating. Read-only and verify surfaces (willRemediate=false) still
count not-pinned as a genuine coverage gap.

Confined to the terminal renderer and its test; finding classification
(checks/IsValid/NeedsAttention) is unchanged.

Resolves github/actions-dispatch#802
The #802 remediable-only logic treated any workflow whose only invalid
finding was not-pinned as "about to be pinned", but diagnose.go also
reports fatal workflow load / deps-read failures as workflow-level
not-pinned (SeverityError, no ActionRef). Those are not remediable, so
suppressing them let a genuinely broken workflow drop out of the failed
count, and the unconditional not-pinned exclusion could blank out the
only reason in the summary line.

Restrict remediable-only to dep-level not-pinned (non-nil ActionRef), and
exclude not-pinned from the summary only when another category already
explains a failure. Update the regression test to model dep-level
not-pinned at its production SeverityError and add fatal-load-error cases.

Adds a catalog scenario asserting a fresh multi-workflow pin run does not
report "N of N workflows failed".
@nodeselector
nodeselector force-pushed the nodeselector-issue-802-summary-miscount branch from aef0dba to c9b9b32 Compare July 24, 2026 13:18
@nodeselector
nodeselector merged commit 2c05f92 into main Jul 24, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants