Fix-mode `--json` reports a `sha-as-ref` warning for a ref the same run just rewrote to a tag

Abierto
  • ¿Algo no está bien?
#276 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Okabe-Junya ya está trabajando en esto.

Desde el 8/11/2026.

  • #277 de @Okabe-Junya — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
github-actions, go
Área
cli, security

Línea de trabajo

Start by tracing how --json=valid,findings gathers sha-as-ref findings and how the default fix run rewrites workflow uses: lines; the issue does not name implementation files or tests. Reproduce with the supplied workflow and compare the first run's JSON findings with the rewritten line and terminal summary. Done when the first run's JSON no longer reports a warning for the SHA it replaced; linked pull request #277 is already open.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

What happened

A default fix run that rewrites uses: owner/repo@<sha> # vX.Y.Z to uses: owner/[email protected] still emits a sha-as-ref warning in its --json output, keyed by the SHA that is no longer in the workflow.
The remediation says "pin to a tag instead", which is what the run just did. A second run reports nothing. The terminal summary of the same run shows no warning.

Steps to reproduce
mkdir repro && cd repro && git init -q
mkdir -p .github/workflows
cat > .github/workflows/ci.yml <<'EOF'
name: ci
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
EOF
gh actions-lock --no-interactive --json=valid,findings 2>/dev/null

First run output (workflow now reads uses: actions/[email protected]):

{
  "cli_version": "v0.4.1",
  "findings": [
    {
      "workflow": ".github/workflows/ci.yml",
      "category": "sha-as-ref",
      "severity": "warning",
      "confidence": "high",
      "dependency": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
      "detail": "pinned to a bare SHA without a symbolic ref — weakens supply-chain traceability",
      "remediation": "pin to a tag instead: https://github.com/actions/checkout/releases",
      "doc_url": "https://github.com/github/gh-actions-lock/blob/main/docs/troubleshooting.md#sha-as-ref"
    }
  ],
  "lockfile_version": "v0.0.3",
  "valid": true
}

Second run of the same command: "findings": [].

Same first run without --json prints only the pin summary, no warning:

Scanning 1 workflow
Planning pins
Pinned 1 action across 1 workflow
  actions/[email protected] (3d3c42e)
    └─ .github/workflows/ci.yml

With --no-narrow the workflow is left as written and the warning is accurate, so this only affects the default rewrite path.

Expected

Post-fix JSON should not carry a warning whose subject the write removed. Either drop warnings the fix resolved, or re-evaluate sha-as-ref against the rewritten uses: lines.

Environment
  • gh-actions-lock v0.4.1 (gh extension install github/gh-actions-lock --pin v0.4.1), lockfile schema v0.0.3
  • gh 2.x on macOS 26 (arm64), github.com
Lenguaje dominante
Go
Estrellas
317
Forks
24
Merge medio
1 d 8 h
PR fusionados (30 d)
50

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/gh-actions-lock

Todos los issues de github/gh-actions-lock

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.