{{ message }}
Repository navigation
Skip branch scans for symbolic action refs - #93
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Skips reverse-lookup API scans for symbolic action refs while retaining discovery for bare SHAs.
Changes:
- Short-circuits reverse lookup for symbolic refs.
- Removes obsolete HTTP mocks.
- Updates SHA fallback and no-network tests.
Show a summary per file
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
internal/resolve/discover_test.go:426
- A symbolic
@mainref can be classified locally as a branch, so expectingBranchto remain empty contradicts the stated behavior and removeson_branchfrom the resulting pin entry. Assertmainhere while retaining the empty registry to prove classification does not perform an API call.
if deps[0].Branch != "" {
t.Errorf("expected Branch empty, got %q", deps[0].Branch)
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Medium
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Avoid pin-time branch discovery for symbolic action refs such as
@v4and@main.Why
Reverse-looking up every resolved dependency caused unnecessary GitHub API requests and could burn through rate limits even when the original symbolic ref already contained all metadata needed for the lockfile.
How
ReverseLookupnow leaves symbolic refs unchanged. Branch and tag discovery remains limited to bare SHA refs, where a symbolic lockfile ref must actually be recovered.Tests enforce that symbolic refs issue no reverse-lookup requests while bare SHAs retain the existing named, likely, and full-scan fallback behavior.
Risk
Low and reversible. The change removes redundant metadata enrichment for symbolic refs; resolution and SHA verification are unchanged.
Testing
go test ./...