fix: silently skip run-only workflows with no action refs

Workflows that only have run: steps and no uses: directives have nothing
to pin. Previously these would emit a misleading 'not yet pinned' skip
message. Now they're skipped silently since there's no action to take.

Three tiers:
- No uses: at all → skip silently
- Has uses: but no dependencies: section → 'not yet pinned' skip
- Has dependencies: → validate normally

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

root.go

@@ -16,6 +16,7 @@ import (
 
 var errSilent = errors.New("silent error")
 var errNoDeps = errors.New("no dependencies: section found")
+var errNoActions = errors.New("no action references found")
 var newResolver = resolver.New
 
 type pinOptions struct {
@@ -362,6 +363,10 @@ func runCheck(opts *checkOptions) error {
 		}
 		result, err := validateOneFile(workflowPath, r)
 		if err != nil {
+			if errors.Is(err, errNoActions) {
+				// Workflow has only run: steps, no actions to pin — skip silently.
+				continue
+			}
 			if errors.Is(err, errNoDeps) {
 				if opts.JSONFields != "" {
 					aggregate.Warnings = append(aggregate.Warnings,
@@ -725,6 +730,12 @@ func validateOneFile(workflowPath string, r *resolver.Resolver) (*validationResu
 		return nil, err
 	}
 	if len(existingDeps) == 0 {
+		// Check if the workflow even has action references.
+		// Run-only workflows (no uses: directives) need no pinning.
+		refs, _, _ := wf.ExtractActionRefs()
+		if len(refs) == 0 {
+			return nil, errNoActions
+		}
 		return nil, errNoDeps
 	}