address CCR review feedback

- narrowVerifiedEntries: set AutoFixedRef to just the ref, not NWO@ref
- IsWarning: return false for error-level LocalAction findings
- json: only skip warning-level LocalAction findings, not errors
- harness edit: use Shellwords.split + system(*cmd, chdir:) instead
  of interpolating EDITOR into a bash -c string

Author: nodeselector

cmd/gh-actions-lock/format/json.go

@@ -115,7 +115,7 @@ func WriteJSON(w io.Writer, report *checks.Report, valid bool, fieldsCSV, cliVer
 		}
 		for _, wr := range report.Workflows {
 			for _, f := range wr.Findings {
-				if f.Category == checks.RunOnly || f.Category == checks.LocalAction || (f.Category == checks.Valid && f.Severity == checks.SeverityOK) {
+				if f.Category == checks.RunOnly || (f.Category == checks.LocalAction && f.Severity != checks.SeverityError) || (f.Category == checks.Valid && f.Severity == checks.SeverityOK) {
 					continue
 				}
 				allFindings = append(allFindings, findingFromReport(f))
@@ -185,7 +185,7 @@ func WriteJSON(w io.Writer, report *checks.Report, valid bool, fieldsCSV, cliVer
 				Findings: []Finding{},
 			}
 			for _, f := range wr.Findings {
-				if f.Category == checks.RunOnly || f.Category == checks.LocalAction || (f.Category == checks.Valid && f.Severity == checks.SeverityOK) {
+				if f.Category == checks.RunOnly || (f.Category == checks.LocalAction && f.Severity != checks.SeverityError) || (f.Category == checks.Valid && f.Severity == checks.SeverityOK) {
 					continue
 				}
 				wf.Findings = append(wf.Findings, findingFromReport(f))

internal/pin/plan.go

@@ -607,11 +607,12 @@ func narrowVerifiedEntries(ctx context.Context, entries []Entry, opts PlanOption
 				continue
 			}
 		}
-		oldUses := e.NWO + "@" + e.Ref
+		oldRef := e.Ref
+		oldUses := e.NWO + "@" + oldRef
 		newUses := e.NWO + "@" + patchTag
 		rewrites[oldUses] = newUses
 		e.Ref = patchTag
-		e.AutoFixedRef = oldUses
+		e.AutoFixedRef = oldRef
 	}
 	if len(rewrites) == 0 {
 		return nil

internal/pipeline/checks/finding.go

@@ -124,7 +124,7 @@ func (f *Finding) IsWarning() bool {
 	case f.Category == RefMoved:
 		return true
 	case f.Category == LocalAction:
-		return true
+		return f.Severity != SeverityError
 	case f.Category.IsInconclusive():
 		return true
 	case f.Category == NotPinned && f.ActionRef == nil:

test/integration/harness.rb

@@ -1108,9 +1108,9 @@ def shell
                     @last_dir
                   end
             if dir
-              editor = ENV["EDITOR"] || "code"
-              puts "\e[2m$ pushd #{dir} && #{editor} && popd\e[0m"
-              system("bash", "-c", "pushd #{Shellwords.shellescape(dir)} && #{editor} && popd")
+              editor_cmd = Shellwords.split(ENV["EDITOR"] || "code")
+              puts "\e[2m$ cd #{dir} && #{editor_cmd.join(' ')}\e[0m"
+              system(*editor_cmd, chdir: dir)
             else
               puts "No active scenario directory."
             end