style(pipeline): gofmt, drop duplicate doc comments and dead var

Address Copilot review on #25: gofmt the checks and pipeline files
(parserlock import ordering), remove the accidentally duplicated doc
comments across parse.go, reach_partition.go, reach_findings.go, and
finding_enrich.go, replace the stray CollectReachDeps doc above
populateInventoryParents with an accurate one, and drop the dead
endpoint variable in profile.classifyPath.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

internal/pipeline/checks/finding.go

@@ -1,8 +1,8 @@
 package checks
 
 import (
-	"github.com/github/gh-actions-pin/internal/dep"
 	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-pin/internal/dep"
 )
 
 // Finding represents a single diagnosed issue (or clean bill) for a workflow.

internal/pipeline/checks/impostor.go

@@ -3,11 +3,11 @@ package checks
 import (
 	"context"
 
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 	"github.com/github/gh-actions-pin/internal/ghapi"
 	"github.com/github/gh-actions-pin/internal/pinpool"
 	"github.com/github/gh-actions-pin/internal/resolve"
 	"github.com/github/gh-actions-pin/internal/tag"
-	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 )
 
 // ReachabilityChecker is the subset of resolve.Resolver needed to verify

internal/pipeline/checks/misleading.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/github/gh-actions-pin/internal/resolve"
 	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-pin/internal/resolve"
 )
 
 // checkMisleadingSha emits MisleadingSHA when a uses: ref looks

internal/pipeline/checks/parsed.go

@@ -1,8 +1,8 @@
 package checks
 
 import (
-	"github.com/github/gh-actions-pin/internal/dep"
 	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-pin/internal/dep"
 )
 
 // ParsedWorkflow holds the per-workflow parse result that both phases need.

internal/pipeline/checks/run.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"strings"
 
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 	"github.com/github/gh-actions-pin/internal/dep"
 	"github.com/github/gh-actions-pin/internal/workflowfile"
-	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 )
 
 // RunChecks evaluates all enabled validators against the given parsed

internal/pipeline/checks/run_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/github/gh-actions-pin/internal/resolve"
 	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-pin/internal/resolve"
 )
 
 // Typed map keys for the test stub: a small struct per lookup tuple so

internal/pipeline/checks/structural.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/github/gh-actions-pin/internal/dep"
 	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
+	"github.com/github/gh-actions-pin/internal/dep"
 )
 
 // checkNotPinned emits NotPinned for any uses: ref that has no

internal/pipeline/finding_enrich.go

@@ -34,9 +34,6 @@ func attachParent(f *checks.Finding, depByKey map[string]dep.Dependency, directN
 	}
 }
 
-// isTransitivePin reports whether the finding refers to a dep reached via
-// composite expansion (i.e. has parents in the parent map).
-
 // isTransitivePin reports whether the finding refers to a dep reached via
 // composite expansion (i.e. has parents in the parent map).
 func isTransitivePin(f checks.Finding, depByKey map[string]dep.Dependency, parentMap map[string][]string) bool {
@@ -49,16 +46,9 @@ func isTransitivePin(f checks.Finding, depByKey map[string]dep.Dependency, paren
 	return len(parentMap[f.Dependency.Key()]) > 0
 }
 
-// CollectReachDeps returns the deduplicated union of existing deps across the
-// given parsed workflows that will need a fresh reachability network check
-// once diagnostics runs. It mirrors the per-workflow partition diagnose
-// performs internally (see partitionReachByLive) but operates over the union,
-// so callers can pre-warm CheckReachabilityAll once across every unresolved
-// workflow instead of paying the per-workflow repo-warmup + per-dep
-// concurrency cost serially. Pass live as the result of a single
-// ResolveAllRecursive over the union of refs (the resolver cache makes the
-// per-workflow re-lookups inside diagnose free).
-
+// populateInventoryParents fills in the Parents field for transitive inventory
+// entries (those not marked Direct and without parents yet) by looking up each
+// entry's dep key in parentMap.
 func populateInventoryParents(inventory []checks.InventoryEntry, parentMap map[string][]string) {
 	for i := range inventory {
 		if inventory[i].Direct || len(inventory[i].Parents) > 0 {

internal/pipeline/parse.go

@@ -3,14 +3,14 @@ package pipeline
 import (
 	"context"
 
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 	"github.com/github/gh-actions-pin/internal/dep"
 	"github.com/github/gh-actions-pin/internal/ghapi"
 	"github.com/github/gh-actions-pin/internal/lockfile"
 	"github.com/github/gh-actions-pin/internal/pinpool"
 	"github.com/github/gh-actions-pin/internal/pipeline/checks"
 	"github.com/github/gh-actions-pin/internal/resolve"
 	"github.com/github/gh-actions-pin/internal/workflowfile"
-	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 )
 
 // Diagnose scans workflows and produces findings for each.
@@ -36,10 +36,6 @@ func Diagnose(ctx context.Context, paths []string, r *resolve.Resolver, store *l
 	return DiagnoseParsed(ctx, parsed, r, store, pool)
 }
 
-// ParseAll loads and parses every workflow path, returning a slice in input
-// order. onScan, if non-nil, fires with 1-based progress before each workflow
-// is parsed so the UI can render [i/N] without leaking resolver detail.
-
 // ParseAll loads and parses every workflow path, returning a slice in input
 // order. onScan, if non-nil, fires with 1-based progress before each workflow
 // is parsed so the UI can render [i/N] without leaking resolver detail.
@@ -72,10 +68,6 @@ func ParseAll(paths []string, store *lockfile.State, onScan func(done, total int
 	return out
 }
 
-// CollectResolvable returns the deduplicated union of refs and existing deps
-// across all parsed workflows. Use the returned slices to pre-warm the
-// resolver caches once before per-workflow diagnostics.
-
 // CollectResolvable returns the deduplicated union of refs and existing deps
 // across all parsed workflows. Use the returned slices to pre-warm the
 // resolver caches once before per-workflow diagnostics.

internal/pipeline/reach_findings.go

@@ -93,16 +93,6 @@ func reachabilityComplementFindings(
 	return out
 }
 
-// liveReachImpostorFindings emits checks.ImpostorCommit for live-resolved
-// SHAs that come back Unreachable from the live-direct sweep. Operates on
-// synthetic live deps (not pw.ExistingDeps), so it fires for unpinned and
-// transitive-not-in-lockfile cases that reachabilityComplementFindings
-// (keyed on existing deps) can't see.
-//
-// Suppresses duplicates against any prior impostor/forgery finding for the
-// same dep key — the engine's checkImpostorCommit may have already emitted
-// for a direct ref via the live-ref-vs-locked compare in check_misleading.
-
 // liveReachImpostorFindings emits checks.ImpostorCommit for live-resolved
 // SHAs that come back Unreachable from the live-direct sweep. Operates on
 // synthetic live deps (not pw.ExistingDeps), so it fires for unpinned and