fix(check): gracefully skip workflows without pinned dependencies - #6
Merged
Conversation
Three tiers of handling for workflows discovered by --check: - No uses: directives at all (run-only) → skip silently - Has uses: but no dependencies: section → skip with guidance - Has dependencies: section → validate normally Also fixes duplicate error printing in aggregate output and surfaces skipped files as warnings in JSON output for CI consumers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR adjusts the gh actions-pin check command to reduce noisy failures by treating workflows without pinned dependencies as “skipped” (rather than hard errors), while still validating workflows that contain a dependencies: lock section. It also aims to eliminate duplicate human-readable error printing and to surface skipped files as warnings in JSON output.
Changes:
- Introduces sentinel errors to classify “no dependencies section” vs “no action references” and uses them to skip certain workflows during
check. - Adds JSON warnings (and human-readable “skipping …” output) for workflows that appear unpinned.
- Changes human-readable printing to avoid printing
ERRORentries twice (inline + aggregate).
Show a summary per file
| File | Description |
|---|---|
| root.go | Implements skip logic for unpinned/run-only workflows during check, adjusts output behavior, and refactors error printing to reduce duplication. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 3
Comment on lines
+716
to
+720
| refs, _, _ := wf.ExtractActionRefs() | ||
| if len(refs) == 0 { | ||
| return nil, errNoActions | ||
| } | ||
| return nil, errNoDeps |
Comment on lines
+365
to
+377
| if errors.Is(err, errNoActions) { | ||
| // Workflow has only run: steps, no actions to pin — skip silently. | ||
| continue | ||
| } | ||
| if errors.Is(err, errNoDeps) { | ||
| if opts.JSONFields != "" { | ||
| aggregate.Warnings = append(aggregate.Warnings, | ||
| fmt.Sprintf("%s: not yet pinned (run `gh actions-pin --write` first)", workflowPath)) | ||
| } else { | ||
| fmt.Fprintf(os.Stderr, "skipping %s: not yet pinned (run `gh actions-pin --write` first)\n", workflowPath) | ||
| } | ||
| continue | ||
| } |
Comment on lines
+409
to
+419
| // Print errors and warnings in human-readable mode. | ||
| // Skip ERROR entries — those were already printed inline when validateOneFile returned an error. | ||
| for _, e := range aggregate.Errors { | ||
| if e.Type == "ERROR" { | ||
| continue | ||
| } | ||
| fmt.Fprintf(os.Stderr, "error: [%s] %s: %s\n", e.Type, e.Dependency, e.Details) | ||
| } | ||
| for _, w := range aggregate.Warnings { | ||
| fmt.Fprintf(os.Stderr, "warning: %s\n", w) | ||
| } |
|
Warning This is an internal experiment to assess Copilot's ability to auto-approve PRs. Please 👍 this comment if the assessment below is correct and 👎 if not. Feedback in #f-ccr-auto-approve is appreciated! Copilot thinks this PR is not ready to approve — see review comments for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Gracefully handle workflow files that have no pinned dependencies during
check, instead of spamming[ERROR]for each one.Why
When running
gh actions-pin checkin a repo with many workflows, files without adependencies:section produce noisy error output:These aren't errors — they're either not-yet-pinned files (actionable) or run-only workflows (nothing to do). Treating them as errors fails the check and obscures real validation failures.
How
Three-tier handling based on workflow content:
uses:directives (run-only)uses:but nodependencies:sectiondependencies:sectionAlso fixes duplicate error printing:
validateOneFileerrors were printed inline AND again in the aggregate error loop. Now the aggregate loop skipsERROR-type entries that were already printed.Skipped files surface as warnings in JSON output so CI consumers can see what was skipped without failing the check.
Risk
--checkbehavior change: previously-failing repos may now passTesting