Support GH_ACTIONS_PIN_WORKFLOWS_DIR for non-standard workflow locations

[nodeselector]

The CLI hardcodes .github/workflows/ as the scan root for workflow discovery and lockfile placement. In lab and non-standard environments, workflows may live at a different path.

This adds an undocumented GH_ACTIONS_PIN_WORKFLOWS_DIR env var that overrides where the CLI looks for workflow files and the actions.lock lockfile. When unset, behavior is unchanged.

Approach

Three packages touched, all surgical:

• workflowfile: extracted DiscoverWorkflowsIn(dir) from DiscoverWorkflows() -- the original becomes a thin wrapper passing .github/workflows
• lockfile: replaced State.repoRoot with State.lockPath (the field was only used for lockfile path computation). Added LoadStateAt(path, meta) constructor for explicit lockfile paths; LoadState wraps it
• root.go: newRun reads the env var and routes discovery + lockfile I/O through the override dir when set

Testing

• Added tests for DiscoverWorkflowsIn (happy path + missing dir)
• All existing tests pass unchanged -- the refactor preserves existing call signatures

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for overriding the GitHub Actions workflows directory (and corresponding actions.lock location) via the GH_ACTIONS_PIN_WORKFLOWS_DIR environment variable, while preserving default behavior when unset.

Changes:

• Extracted workflowfile.DiscoverWorkflowsIn(dir) for workflow discovery in non-standard directories.
• Added lockfile.LoadStateAt(path, meta) and refactored state to store an explicit lockfile path.
• Updated CLI run wiring to route workflow discovery + lockfile I/O through the override directory when provided.

Show a summary per file

File	Description
internal/workflowfile/workflowfile.go	Adds DiscoverWorkflowsIn(dir) and keeps DiscoverWorkflows() as a wrapper for the default directory.
internal/workflowfile/workflowfile_test.go	Adds focused unit tests for DiscoverWorkflowsIn (happy path + missing dir).
internal/lockfile/state.go	Refactors state to store lockPath and introduces LoadStateAt to load/save lockfiles at explicit paths.
cmd/gh-actions-pin/root.go	Reads GH_ACTIONS_PIN_WORKFLOWS_DIR and uses it to drive workflow discovery and lockfile location.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

internal/workflowfile/workflowfile.go:102

• The workflow-file filtering logic here (ReadDir + ext check + sort) is effectively duplicated elsewhere (e.g., directory expansion of user-provided paths). To reduce drift risk, consider extracting a small shared helper for listing workflow files in a directory and reusing it across call sites.

// DiscoverWorkflowsIn finds all workflow files (*.yml, *.yaml) in dir.
// Returns nil if the directory doesn't exist.
func DiscoverWorkflowsIn(dir string) ([]string, error) {
	entries, err := os.ReadDir(dir)
	if os.IsNotExist(err) {
		return nil, nil
	}

• Files reviewed: 4/4 changed files
• Comments generated: 2