pipeline: skip resolve/reachability for local-path workflows

Local-path workflows are bailed out at diagnose time, but their action
refs were still fed through the resolve and reachability phases because
PartitionRefs found no matching lockfile entries. On mcv3-boot this
caused 65 redundant HTTP calls (~6s) on every rerun.

Fix: mark local-path workflows as Resolved=true before the partition
loop so they never enter the network path. Also teach PartitionRefs to
match bare-SHA refs against lockfile deps by SHA (not just by tag ref)
for correctness in mixed-pinning repos.

Result: mcv3-boot rerun drops from ~6s to ~200ms, 0 HTTP requests.

Author: nodeselector

internal/pipeline/checks/parsed.go

@@ -40,18 +40,22 @@ type ParsedWorkflow struct {
 }
 
 // PartitionRefs splits refs into recorded (matching a lockfile entry by
-// NWO@Ref) and unrecorded (need network resolution). When an error
-// prevented loading refs or deps, everything is unrecorded.
+// NWO@Ref or NWO@SHA) and unrecorded (need network resolution). When an
+// error prevented loading refs or deps, everything is unrecorded.
 func (pw ParsedWorkflow) PartitionRefs() (recorded, unrecorded []parserlock.ActionRef) {
 	if pw.LoadErr != nil || pw.DepsErr != nil {
 		return nil, pw.Refs
 	}
 	if len(pw.Refs) == 0 {
 		return nil, nil
 	}
-	haveDep := make(map[string]bool, len(pw.ExistingDeps))
+	haveDep := make(map[string]bool, len(pw.ExistingDeps)*2)
 	for _, d := range pw.ExistingDeps {
-		haveDep[strings.ToLower(d.NWO)+"@"+d.Ref] = true
+		nwo := strings.ToLower(d.NWO)
+		haveDep[nwo+"@"+d.Ref] = true
+		if d.SHA != "" {
+			haveDep[nwo+"@"+strings.ToLower(d.SHA)] = true
+		}
 	}
 	for _, r := range pw.Refs {
 		if haveDep[strings.ToLower(r.Owner+"/"+r.Repo)+"@"+r.Ref] {
@@ -70,16 +74,17 @@ func (pw ParsedWorkflow) IsFullyRecorded() bool {
 	return len(pw.Refs) == 0 || len(unrecorded) == 0
 }
 
-// RecordedDeps returns the subset of ExistingDeps whose NWO@Ref matches
-// one of the given recorded refs.
+// RecordedDeps returns the subset of ExistingDeps whose NWO@Ref or
+// NWO@SHA matches one of the given recorded refs.
 func (pw ParsedWorkflow) RecordedDeps(recorded []parserlock.ActionRef) []dep.Dependency {
 	refKeys := make(map[string]bool, len(recorded))
 	for _, r := range recorded {
 		refKeys[strings.ToLower(r.Owner+"/"+r.Repo)+"@"+r.Ref] = true
 	}
 	var out []dep.Dependency
 	for _, d := range pw.ExistingDeps {
-		if refKeys[d.Key()] {
+		nwo := strings.ToLower(d.NWO)
+		if refKeys[nwo+"@"+d.Ref] || refKeys[nwo+"@"+strings.ToLower(d.SHA)] {
 			out = append(out, d)
 		}
 	}

internal/pipeline/run.go

@@ -58,6 +58,13 @@ func Run(ctx context.Context, opts RunOptions) (*RunResult, error) {
 	recordedKeys := make(map[string]bool)
 	if !opts.Rescan {
 		for i := range parsed {
+			// Local-path workflows are skipped at diagnose time; don't
+			// waste network calls resolving their refs.
+			if len(parsed[i].LocalPaths) > 0 {
+				parsed[i].Resolved = true
+				skippedRescan++
+				continue
+			}
 			recorded, unrecorded := parsed[i].PartitionRefs()
 			if len(parsed[i].Refs) == 0 || len(unrecorded) == 0 {
 				parsed[i].Resolved = true

internal/pipeline/run_test.go

@@ -100,6 +100,19 @@ func TestPartitionRefs(t *testing.T) {
 			wantRecordedLen: 2, // both sub-actions match the dep
 			wantUnrecordLen: 0,
 		},
+		{
+			name: "bare SHA ref matches by SHA",
+			pw: checks.ParsedWorkflow{
+				Refs: []parserlock.ActionRef{
+					ref("actions", "checkout", "", "de0fac2e4500dabe0009e67214ff5f5447ce83dd"),
+				},
+				ExistingDeps: []dep.Dependency{
+					mkDep("actions/checkout", "v6.0.2", "de0fac2e4500dabe0009e67214ff5f5447ce83dd"),
+				},
+			},
+			wantRecordedLen: 1,
+			wantUnrecordLen: 0,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {