Fix spinner flicker in embedded terminals

cmd/gh-actions-pin/check.go

@@ -269,12 +269,6 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 	// Strict gate — any blocking finding is a non-zero exit.
 	if opts.noFix {
 		console.StopProgress()
-		if gc := r.GHClient(); gc != nil {
-			if ssoURL := gc.SSOURL(); ssoURL != "" {
-				console.TermBlank()
-				console.TermDetail("Authorize in your web browser:  %s", ssoURL)
-			}
-		}
 		if opts.jsonFields != "" {
 			if err := format.WriteJSON(out, report, valid, opts.jsonFields, cliVersion(), store.File().Version); err != nil {
 				return err
@@ -332,7 +326,7 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 	if path, werr := record.WriteJSON(); werr == nil {
 		defer func() {
 			console.TermBlank()
-			console.TermNeutral("Resolution record: %s", path)
+			console.TermDetail("Resolution record: %s", path)
 		}()
 	}
 

cmd/gh-actions-pin/format/terminal.go

@@ -37,9 +37,7 @@ func PresentResults(out *ui.UI, report *checks.Report, valid bool, willRemediate
 	}
 	checked := validCount + failedCount
 
-	if valid && checked > 0 {
-		out.Success("All %d %s valid", checked, ui.Pluralize(checked, "workflow", "workflows"))
-	} else if checked > 0 {
+	if !valid && checked > 0 {
 		renderErrorFindings(out, report, failedCount, checked)
 	}
 

cmd/gh-actions-pin/format/terminal_test.go

@@ -135,6 +135,24 @@ func TestPresentResults_WarningsReachTerminal(t *testing.T) {
 	}
 }
 
+// TestPresentResults_NoSuccessLine verifies PresentResults no longer emits
+// the "All N workflows valid" success line — renderPinSummary owns that.
+func TestPresentResults_NoSuccessLine(t *testing.T) {
+	u, buf := newTestUI()
+	report := &checks.Report{
+		Workflows: []checks.WorkflowReport{
+			{Path: ".github/workflows/a.yml"},
+			{Path: ".github/workflows/b.yml"},
+		},
+	}
+	PresentResults(u, report, true, false)
+
+	got := buf.String()
+	if strings.Contains(got, "All") && strings.Contains(got, "valid") {
+		t.Errorf("PresentResults should not print success line, got:\n%s", got)
+	}
+}
+
 // TestPresentResults_RemediateHints locks the willRemediate-aware "↳"
 // follow-up lines that PresentResults emits under each warning headline.
 // Categories the remediator auto-fixes (NotPinned, SHAAsRef) flip between

cmd/gh-actions-pin/pin_summary.go

@@ -35,6 +35,10 @@ func renderPinSummary(console *ui.UI, record *pin.Record, report *checks.Report,
 	}
 
 	total := len(report.Workflows)
+	if total == 0 {
+		console.TermNeutral("No workflows to check")
+		return nil
+	}
 	if len(pinned) == 0 && len(investigated) == 0 && len(unresolvedEntries) == 0 && !hasInconclusive {
 		console.TermSuccess("All %d %s valid", total, ui.Pluralize(total, "workflow", "workflows"))
 		if skippedRescan > 0 {

cmd/gh-actions-pin/root.go

@@ -124,7 +124,8 @@ $ gh actions-pin --no-fix --json=valid,findings
 // from the existing lockfile so repeat scans short-circuit the per-branch
 // Compare walk. newResolver is the DI seam; pass nil for production wiring.
 func newRun(workflowPaths []string, hostname string, pool *pinpool.Pool, newResolver resolverFunc) ([]string, *resolve.Resolver, *lockfile.State, error) {
-	paths, err := discoverWorkflowPaths(workflowPaths)
+	workflowsDir := os.Getenv("GH_ACTIONS_PIN_WORKFLOWS_DIR")
+	paths, err := discoverWorkflowPaths(workflowPaths, workflowsDir)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -139,7 +140,12 @@ func newRun(workflowPaths []string, hostname string, pool *pinpool.Pool, newReso
 		return nil, nil, nil, err
 	}
 
-	store, err := lockfile.LoadState(".", r)
+	var store *lockfile.State
+	if workflowsDir != "" {
+		store, err = lockfile.LoadStateAt(filepath.Join(workflowsDir, "actions.lock"), r)
+	} else {
+		store, err = lockfile.LoadState(".", r)
+	}
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("opening lockfile: %w", err)
 	}
@@ -148,11 +154,22 @@ func newRun(workflowPaths []string, hostname string, pool *pinpool.Pool, newReso
 	return paths, r, store, nil
 }
 
-func discoverWorkflowPaths(existing []string) ([]string, error) {
+func discoverWorkflowPaths(existing []string, workflowsDir string) ([]string, error) {
 	if len(existing) > 0 {
 		return expandWorkflowPaths(existing)
 	}
 
+	if workflowsDir != "" {
+		paths, err := workflowfile.DiscoverWorkflowsIn(workflowsDir)
+		if err != nil {
+			return nil, err
+		}
+		if len(paths) == 0 {
+			return nil, fmt.Errorf("no workflow files found in %s", workflowsDir)
+		}
+		return paths, nil
+	}
+
 	paths, err := workflowfile.DiscoverWorkflows()
 	if err != nil {
 		return nil, err

internal/lockfile/state.go

@@ -38,7 +38,7 @@ type MetadataResolver interface {
 // a single store instance without external synchronization.
 type State struct {
 	mu       sync.Mutex
-	repoRoot string
+	lockPath string // full path to actions.lock on disk
 	file     parserlock.File
 	meta     MetadataResolver
 	idCache  map[string][2]int64
@@ -48,8 +48,14 @@ type State struct {
 // LoadState reads the lockfile at repoRoot, returning an empty in-memory file
 // when none exists on disk.
 func LoadState(repoRoot string, meta MetadataResolver) (*State, error) {
-	full := filepath.Join(repoRoot, parserlock.Path)
-	contents, err := os.ReadFile(full)
+	return LoadStateAt(filepath.Join(repoRoot, parserlock.Path), meta)
+}
+
+// LoadStateAt reads the lockfile at the given path, returning an empty
+// in-memory file when none exists on disk. Use this when the lockfile
+// lives outside the standard .github/workflows/ location.
+func LoadStateAt(lockfilePath string, meta MetadataResolver) (*State, error) {
+	contents, err := os.ReadFile(lockfilePath)
 
 	var file parserlock.File
 	switch {
@@ -88,7 +94,7 @@ func LoadState(repoRoot string, meta MetadataResolver) (*State, error) {
 	}
 
 	s := &State{
-		repoRoot: repoRoot,
+		lockPath: lockfilePath,
 		file:     file,
 		meta:     meta,
 		idCache:  map[string][2]int64{},
@@ -360,7 +366,7 @@ func (s *State) Save() error {
 		}
 	}
 
-	full := filepath.Join(s.repoRoot, parserlock.Path)
+	full := s.lockPath
 
 	if len(s.file.Dependencies) == 0 && len(s.file.Workflows) == 0 {
 		if err := os.Remove(full); err != nil && !errors.Is(err, os.ErrNotExist) {