Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Repository-transfer fix mode cannot rewrite normalized reusable workflow references.
1 open finding
What changed in this PR
Adds lock coverage for remote job-level reusable workflow calls.
Changes:
- Normalizes reusable workflow calls to repository/ref dependencies.
- Adds pipeline parsing regression coverage.
| File | Description |
|---|---|
internal/workflowfile/workflowfile.go |
Parses remote reusable workflow references. |
internal/pipeline/parse_test.go |
Tests normalized reusable workflow extraction. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
jay23606
force-pushed
the
codex/issue-129-reusable-workflow-lock-refs
branch
from
October 16, 2026 20:14
74b9b1a to
ba2ba8f
Compare
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
jay23606
force-pushed
the
codex/issue-129-reusable-workflow-lock-refs
branch
from
October 20, 2026 03:08
ba2ba8f to
edd16ec
Compare
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
nodeselector
added a commit
that referenced
this pull request
Oct 20, 2026
Harden the locally integrated community #180 implementation: require immutable commit responses, preserve snapshot origin/ref across redirects, reject truncated inventories and target ambiguity, inspect discovered reusable callees, and prove read-only failure behavior. Address #179 using the reusable-workflow parsing distinction highlighted by jay23606 in #161, without claiming caller lockfile enforcement the runner does not implement. Mutable job calls fail with direct full-SHA guidance; SHA calls expose the unverified callee graph. Preserve job refs during action narrowing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
jay23606
force-pushed
the
codex/issue-129-reusable-workflow-lock-refs
branch
from
October 20, 2026 15:11
edd16ec to
adc6532
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Include remote reusable workflow calls from job-level
jobs.<id>.usesin the lock scan. Normalize each call to its repository and ref so verification reports missing pins and fix mode retains required lock entries.Fixes #129
Validation
go test -count=1 ./internal/pipeline ./internal/workflowfilepassed.go vet ./...andgo build ./cmd/gh-actions-lockpassed.mainand passed twice with this change.TestCheckCommand_JSONGoldentimed out on both cleanmainand this branch while writing its JSON output. The repository declares Go 1.25.8; local Go is 1.27.0.