{{ message }}
Repository navigation
Add --relock to bump moved branch and version refs - #88
Merged
Merged
Conversation
Mutable refs (branches like main, partial versions like v4) are trusted from the lockfile and only verified under --rescan, which emits a benign ref-moved warning without advancing the pin. Because a ref-moved finding doesn't make a workflow "need attention", the re-pin path never ran, so there was no way to bump what main points at. Add a --relock flag that re-resolves refs whose upstream ref legitimately advanced (ref-moved) and rewrites the lockfile to the current SHA. It implies --rescan (must detect movement) and, unlike --accept-moved, does NOT accept unreachable-pin findings, so a pin whose commit is no longer reachable upstream stays a hard error. Implementation: - pruneStaleInventory prunes ref-moved deps under relock (unreachable-pin stays accept-moved-only) so the moved dep re-resolves live. - needsRepin routes ref-moved workflows through the live re-pin path when relocking/accepting instead of the trust-inventory fast path. - informationalEntries no longer records ref-moved for investigation when the run re-pins it, so a clean relock exits zero. - Shared checks classification (NeedsAttention/IsValid) is untouched. Resolves github/actions-dispatch#751
There was a problem hiding this comment.
⚠️ Not ready to approve
Relock can miss moved transitive pins and rewrite unreachable transitive pins before returning an error.
Pull request overview
Adds --relock to refresh moved mutable action references while intending to preserve unreachable-pin safety.
Changes:
- Wires
--relockinto CLI validation and rescan behavior. - Adds relock-specific pin planning and inventory pruning.
- Documents and tests direct branch relocking.
File summaries
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 2
- Review effort level: Medium
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… pins Address two review findings on the --relock path: - A moved *transitive* dep is pruned from inventory but is not a direct ActionRef, so partitionByInventory marked nothing unrecorded and the verified fast path silently dropped it at its stale SHA. Force the workflow's direct roots through recursive resolution when a ref-moved finding is present under --relock/--accept-moved, so the moved transitive is re-pinned to its current SHA. - --relock must not rewrite a workflow that still carries an unreachable-pin finding: re-resolving a moved sibling pulls the whole tree (including the possibly-tampered, possibly-transitive unreachable dep) through resolution and would commit it at a live SHA before the hard-error gate runs. Leave such workflows untouched; the unreachable pin still fails the run. --accept-moved is exempt by design. Add pin unit tests for both behaviours and a --relock stub scenario to the shared catalog that bumps a moved branch ref to the live head.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
--relockflag that re-resolves mutable refs (branches likemain, partial versions likev4) whose upstream head has advanced, and rewrites the lockfile to the current SHA.Why
Mutable refs are trusted from the lockfile and only verified under
--rescan, which emits a benignref-movedwarning but never advances the pin. Because aref-movedfinding doesn't make a workflow "need attention", the re-pin path never ran — so there was no way to bump whatmainpoints at. This is the gap reported in github/actions-dispatch#751.How it works
--relockimplies--rescan(it must hit the network to detect what moved).pruneStaleInventoryprunesref-moveddeps under relock so they re-resolve live;unreachable-pinstays--accept-moved-only.needsRepinroutesref-movedworkflows through the live re-pin path instead of the trust-inventory fast path.informationalEntriesno longer recordsref-movedfor investigation when the run re-pins it, so a clean relock exits zero.Safety
Unlike
--accept-moved,--relockdoes not acceptunreachable-pinfindings — a pin whose recorded commit is no longer reachable upstream (possible tampering) stays a hard error. Use--accept-movedto re-resolve those deliberately.Shared finding classification (
NeedsAttention/IsValid/checkscategories) is untouched.Tests
internal/pin/relock_test.go: prune/route logic for relock vs accept-moved.cmd/gh-actions-lock/command_test.go: fix-mode--relockrewrites the lockfile from the stale SHA to the live head; a default run leaves a trusted branch ref untouched.verify_test.go:--relockimplies--rescan;--relock --verify-localconflicts.Resolves github/actions-dispatch#751