Fix-mode `--json` reports a `sha-as-ref` warning for a ref the same run just rewrote to a tag

Offen
  • Stimmt etwas nicht?
#276 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@Okabe-Junya arbeitet bereits daran.

Seit 08.11.2026.

  • #277 von @Okabe-Junya — offen

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
35/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Veraltet
Tech-Stack
github-actions, go
Bereich
cli, security

Rechercherichtung

Start by tracing how --json=valid,findings gathers sha-as-ref findings and how the default fix run rewrites workflow uses: lines; the issue does not name implementation files or tests. Reproduce with the supplied workflow and compare the first run's JSON findings with the rewritten line and terminal summary. Done when the first run's JSON no longer reports a warning for the SHA it replaced; linked pull request #277 is already open.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

What happened

A default fix run that rewrites uses: owner/repo@<sha> # vX.Y.Z to uses: owner/[email protected] still emits a sha-as-ref warning in its --json output, keyed by the SHA that is no longer in the workflow.
The remediation says "pin to a tag instead", which is what the run just did. A second run reports nothing. The terminal summary of the same run shows no warning.

Steps to reproduce
mkdir repro && cd repro && git init -q
mkdir -p .github/workflows
cat > .github/workflows/ci.yml <<'EOF'
name: ci
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
EOF
gh actions-lock --no-interactive --json=valid,findings 2>/dev/null

First run output (workflow now reads uses: actions/[email protected]):

{
  "cli_version": "v0.4.1",
  "findings": [
    {
      "workflow": ".github/workflows/ci.yml",
      "category": "sha-as-ref",
      "severity": "warning",
      "confidence": "high",
      "dependency": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
      "detail": "pinned to a bare SHA without a symbolic ref — weakens supply-chain traceability",
      "remediation": "pin to a tag instead: https://github.com/actions/checkout/releases",
      "doc_url": "https://github.com/github/gh-actions-lock/blob/main/docs/troubleshooting.md#sha-as-ref"
    }
  ],
  "lockfile_version": "v0.0.3",
  "valid": true
}

Second run of the same command: "findings": [].

Same first run without --json prints only the pin summary, no warning:

Scanning 1 workflow
Planning pins
Pinned 1 action across 1 workflow
  actions/[email protected] (3d3c42e)
    └─ .github/workflows/ci.yml

With --no-narrow the workflow is left as written and the warning is accurate, so this only affects the default rewrite path.

Expected

Post-fix JSON should not carry a warning whose subject the write removed. Either drop warnings the fix resolved, or re-evaluate sha-as-ref against the rewritten uses: lines.

Environment
  • gh-actions-lock v0.4.1 (gh extension install github/gh-actions-lock --pin v0.4.1), lockfile schema v0.0.3
  • gh 2.x on macOS 26 (arm64), github.com
Vorherrschende Sprache
Go
Sterne
317
Forks
24
Ø Merge
1 T. 8 Std.
Gemergte PRs (30 T.)
50

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus github/gh-actions-lock

Alle Issues in github/gh-actions-lock

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.