Fix-mode `--json` reports a `sha-as-ref` warning for a ref the same run just rewrote to a tag

Ouverte
  • Quelque chose ne va pas ?
#276 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@Okabe-Junya y travaille déjà.

Depuis le 8/11/2026.

  • #277 par @Okabe-Junya — ouverte

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
À l'abandon
Stack technique
github-actions, go
Domaine
cli, security

Piste de recherche

Start by tracing how --json=valid,findings gathers sha-as-ref findings and how the default fix run rewrites workflow uses: lines; the issue does not name implementation files or tests. Reproduce with the supplied workflow and compare the first run's JSON findings with the rewritten line and terminal summary. Done when the first run's JSON no longer reports a warning for the SHA it replaced; linked pull request #277 is already open.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

What happened

A default fix run that rewrites uses: owner/repo@<sha> # vX.Y.Z to uses: owner/[email protected] still emits a sha-as-ref warning in its --json output, keyed by the SHA that is no longer in the workflow.
The remediation says "pin to a tag instead", which is what the run just did. A second run reports nothing. The terminal summary of the same run shows no warning.

Steps to reproduce
mkdir repro && cd repro && git init -q
mkdir -p .github/workflows
cat > .github/workflows/ci.yml <<'EOF'
name: ci
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
EOF
gh actions-lock --no-interactive --json=valid,findings 2>/dev/null

First run output (workflow now reads uses: actions/[email protected]):

{
  "cli_version": "v0.4.1",
  "findings": [
    {
      "workflow": ".github/workflows/ci.yml",
      "category": "sha-as-ref",
      "severity": "warning",
      "confidence": "high",
      "dependency": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
      "detail": "pinned to a bare SHA without a symbolic ref — weakens supply-chain traceability",
      "remediation": "pin to a tag instead: https://github.com/actions/checkout/releases",
      "doc_url": "https://github.com/github/gh-actions-lock/blob/main/docs/troubleshooting.md#sha-as-ref"
    }
  ],
  "lockfile_version": "v0.0.3",
  "valid": true
}

Second run of the same command: "findings": [].

Same first run without --json prints only the pin summary, no warning:

Scanning 1 workflow
Planning pins
Pinned 1 action across 1 workflow
  actions/[email protected] (3d3c42e)
    └─ .github/workflows/ci.yml

With --no-narrow the workflow is left as written and the warning is accurate, so this only affects the default rewrite path.

Expected

Post-fix JSON should not carry a warning whose subject the write removed. Either drop warnings the fix resolved, or re-evaluate sha-as-ref against the rewritten uses: lines.

Environment
  • gh-actions-lock v0.4.1 (gh extension install github/gh-actions-lock --pin v0.4.1), lockfile schema v0.0.3
  • gh 2.x on macOS 26 (arm64), github.com
Langage dominant
Go
Étoiles
317
Forks
24
Merge moyen
1 j 8 h
PR mergées (30 j)
50

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/gh-actions-lock

Toutes les issues de github/gh-actions-lock

Issues similaires

Plus d'issues Go

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.