wip

Author: nodeselector

internal/doctor/diagnose.go

@@ -193,12 +193,20 @@ func diagnoseOneWorkflow(path string, r *resolver.Resolver) WorkflowReport {
 		}
 		if !strings.EqualFold(existing.SHA, live.SHA) {
 			liveCopy := live
+			parts := strings.SplitN(existing.NWO, "/", 3)
+			var compareHint string
+			if len(parts) >= 2 {
+				compareHint = fmt.Sprintf(
+					"\n  → Compare: https://github.com/%s/%s/compare/%s...%s\n  → Releases: https://github.com/%s/%s/releases\n  → If unexpected, reach out to the action maintainer",
+					parts[0], parts[1], existing.SHA, live.SHA,
+					parts[0], parts[1])
+			}
 			wr.Findings = append(wr.Findings, Finding{
 				WorkflowPath: path,
 				Category:     CategoryTampered,
 				Severity:     SeverityError,
 				Dependency:   &existing,
-				Detail:       fmt.Sprintf("pinned %s but ref now resolves to %s", existing.SHA[:12], live.SHA[:12]),
+				Detail:       fmt.Sprintf("pinned %s but ref now resolves to %s%s", existing.SHA[:12], live.SHA[:12], compareHint),
 				Remediation:  fmt.Sprintf("update to %s with `gh actions-pin upgrade`", liveCopy.SHA[:12]),
 			})
 		}

internal/doctor/is_upgrade_test.go

@@ -33,3 +33,27 @@ fmt.Printf("✓ %-20s → %-30s  upgrade=%v\n", tc.current, tc.latest, got)
 }
 }
 }
+
+func TestIsNarrowedVersion(t *testing.T) {
+	cases := []struct {
+		mutable, narrowed string
+		want              bool
+	}{
+		{"v4", "v4.1.0", true},
+		{"v4", "v4.0.0", true},
+		{"v4.2", "v4.2.1", true},
+		{"v4.2", "v4.2.0", true},
+		{"v4", "v5.0.0", false},     // different major
+		{"v4.2", "v4.3.0", false},   // different minor
+		{"v4.1.0", "v4.1.0", true},  // identity (full semver is its own narrowing)
+		{"v4", "v4", false},         // mutable→mutable, not narrowed
+		{"main", "v4.1.0", false},   // non-version
+		{"v4", "v4.1.0-beta", false}, // pre-release
+	}
+	for _, tc := range cases {
+		got := IsNarrowedVersion(tc.mutable, tc.narrowed)
+		if got != tc.want {
+			t.Errorf("IsNarrowedVersion(%q, %q) = %v, want %v", tc.mutable, tc.narrowed, got, tc.want)
+		}
+	}
+}