fix(pin): retain on-disk impostor pins on co-located re-pin

Fix-mode dropped an impostor-flagged dep from a workflow's pin set whenever
a co-located bump forced that workflow to be rewritten, shrinking the list
toward [] and trivially passing runner enforcement. Re-add the existing
on-disk pin (kept direct) so the blocking finding + exit 1 still stand but
the pin is never silently lost.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

internal/pin/commit.go

@@ -5,9 +5,11 @@ import (
 	"fmt"
 	"os"
 	"runtime"
+	"strings"
 
 	"github.com/github/gh-actions-pin/internal/dep"
 	"github.com/github/gh-actions-pin/internal/lockfile"
+	"github.com/github/gh-actions-pin/internal/pipeline/checks"
 	"github.com/github/gh-actions-pin/internal/workflowfile"
 	"golang.org/x/sync/errgroup"
 )
@@ -64,6 +66,7 @@ func Commit(ctx context.Context, rec *Record, store *lockfile.State, copts *Comm
 		wfKey := workflowfile.KeyFromPath(wfPath)
 		parentMap := buildParentMap(rec, wfPath)
 		directKeys := buildDirectKeys(rec, wfPath)
+		deps = retainImpostorPins(rec, store, wfPath, deps, directKeys)
 		if err := store.Set(ctx, wfKey, deps, parentMap, directKeys); err != nil {
 			return fmt.Errorf("updating lockfile for %s: %w", wfPath, err)
 		}
@@ -115,6 +118,42 @@ func groupPinnedByWorkflow(rec *Record) map[string][]dep.Dependency {
 	return result
 }
 
+// retainImpostorPins re-adds the workflow's existing on-disk pins for any
+// impostor-flagged dep so a co-located re-pin never silently drops them.
+func retainImpostorPins(rec *Record, store *lockfile.State, wfPath string, deps []dep.Dependency, directKeys map[string]bool) []dep.Dependency {
+	impostor := make(map[string]bool)
+	for _, e := range rec.Entries {
+		if e.Resolution != Investigate || e.Issue != string(checks.ImpostorCommit) {
+			continue
+		}
+		for _, wf := range e.Workflows {
+			if wf == wfPath {
+				impostor[strings.ToLower(e.NWO+"@"+e.Ref)] = true
+			}
+		}
+	}
+	if len(impostor) == 0 {
+		return deps
+	}
+	existing, err := store.Get(workflowfile.KeyFromPath(wfPath))
+	if err != nil {
+		return deps
+	}
+	have := make(map[string]bool, len(deps))
+	for _, d := range deps {
+		have[strings.ToLower(d.NWO+"@"+d.Ref)] = true
+	}
+	for _, d := range existing {
+		k := strings.ToLower(d.NWO + "@" + d.Ref)
+		if impostor[k] && !have[k] {
+			deps = append(deps, d)
+			directKeys[d.Key()] = true
+			have[k] = true
+		}
+	}
+	return deps
+}
+
 func buildParentMap(rec *Record, wfPath string) map[string][]string {
 	pm := make(map[string][]string)
 	for _, e := range rec.Entries {

internal/pin/retain_impostor_test.go

@@ -0,0 +1,91 @@
+package pin
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/github/gh-actions-pin/internal/dep"
+	"github.com/github/gh-actions-pin/internal/lockfile"
+	"github.com/github/gh-actions-pin/internal/pipeline/checks"
+	"github.com/github/gh-actions-pin/internal/workflowfile"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeMeta struct{}
+
+func (fakeMeta) RepoIDs(_ context.Context, _, _ string) (int64, int64, error) {
+	return 1, 2, nil
+}
+
+// A co-located bump forces a workflow rewrite; the impostor pin already on
+// disk must be retained, not silently dropped toward an empty pin list.
+func TestRetainImpostorPins_keepsExistingPinOnColocatedRepin(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".github", "workflows"), 0o755))
+	wfPath := filepath.Join(dir, ".github", "workflows", "ci.yml")
+	wfKey := workflowfile.KeyFromPath(wfPath)
+
+	store, err := lockfile.LoadState(dir, fakeMeta{})
+	require.NoError(t, err)
+
+	seed := []dep.Dependency{
+		{NWO: "bad/impostor", Ref: "v1", Tag: "v1", Branch: "main", SHA: "1111111111111111111111111111111111111111", HashAlgo: "sha1"},
+		{NWO: "actions/checkout", Ref: "v4", Tag: "v4", Branch: "main", SHA: "2222222222222222222222222222222222222222", HashAlgo: "sha1"},
+	}
+	require.NoError(t, store.Set(context.Background(), wfKey, seed, nil, nil))
+	require.NoError(t, store.Save())
+
+	// Re-pin: checkout bumps (Pinned), impostor flagged Investigate and dropped from deps.
+	rec := &Record{
+		Entries: []Entry{
+			{NWO: "actions/checkout", Ref: "v5", SHA: "3333333333333333333333333333333333333333", Resolution: Pinned, Direct: true, OnBranch: "main", Workflows: []string{wfPath}},
+			{NWO: "bad/impostor", Ref: "v1", SHA: "1111111111111111111111111111111111111111", Resolution: Investigate, Issue: string(checks.ImpostorCommit), Workflows: []string{wfPath}},
+		},
+	}
+	deps := []dep.Dependency{
+		{NWO: "actions/checkout", Ref: "v5", Branch: "main", SHA: "3333333333333333333333333333333333333333", HashAlgo: "sha1"},
+	}
+	directKeys := map[string]bool{"actions/checkout@v5": true}
+
+	got := retainImpostorPins(rec, store, wfPath, deps, directKeys)
+
+	require.Len(t, got, 2, "impostor pin must be re-added alongside the bumped pin")
+	assert.True(t, directKeys["bad/impostor@v1"], "retained impostor pin must stay direct")
+
+	// Drive the write as Commit does; the impostor pin must survive on disk.
+	require.NoError(t, store.Set(context.Background(), wfKey, got, buildParentMap(rec, wfPath), directKeys))
+	require.NoError(t, store.Save())
+
+	after, err := store.Get(wfKey)
+	require.NoError(t, err)
+	names := map[string]bool{}
+	for _, d := range after {
+		names[d.NWO] = true
+	}
+	assert.True(t, names["bad/impostor"], "impostor pin must survive the re-pin write")
+	assert.True(t, names["actions/checkout"], "bumped pin must be written")
+	assert.Len(t, after, 2, "pin list must not shrink")
+}
+
+// With no co-located new pin, the impostor's workflow is untouched and there
+// is nothing to retain; the helper is a no-op on the deps it is handed.
+func TestRetainImpostorPins_noopWithoutImpostorFinding(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".github", "workflows"), 0o755))
+	wfPath := filepath.Join(dir, ".github", "workflows", "ci.yml")
+
+	store, err := lockfile.LoadState(dir, fakeMeta{})
+	require.NoError(t, err)
+
+	rec := &Record{Entries: []Entry{
+		{NWO: "actions/checkout", Ref: "v5", Resolution: Pinned, Workflows: []string{wfPath}},
+	}}
+	deps := []dep.Dependency{{NWO: "actions/checkout", Ref: "v5"}}
+	directKeys := map[string]bool{"actions/checkout@v5": true}
+
+	got := retainImpostorPins(rec, store, wfPath, deps, directKeys)
+	assert.Len(t, got, 1)
+}