From 66db843492eca2c2a4698d76ada8be547d88f403 Mon Sep 17 00:00:00 2001
From: nerdalytics <97166791+nerdalytics@users.noreply.github.com>
Date: Mon, 20 Apr 2026 23:47:31 +0200
Subject: [PATCH] fix(compare-actions): flag tag mismatch as outdated even when
 SHAs match

Previously, a pin of '@<sha> # v1' against an action whose latest
release is 'v1.0.0' was reported as 'Up to date: (v1)' because the
SHAs coincided (v1 floating tag currently points to v1.0.0's commit).
The consumer's pin label never got refreshed, so logs showed the stale
alias and the auto-update PR never fired.

Now: current_tag != latest_tag triggers outdated-flag even with
matching SHAs. apply-updates.sh already writes both sha + tag on
rewrite, so the resulting PR cleanly updates '# v1' -> '# v1.0.0'
(and '# v1.0.0' -> '# v1.0.1' when the next release arrives).

Added bats coverage:
- flags outdated when SHAs match but tags differ (the exact case here)
- up-to-date when both SHAs and tags match exactly (regression guard)
- up-to-date when SHAs match and current_tag is empty (empty-comment case
  where tag comparison is skipped)
---
 scripts/compare-actions.sh |  7 ++++++-
 tests/compare-actions.bats | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/scripts/compare-actions.sh b/scripts/compare-actions.sh
index d8efa8d..7c154d6 100755
--- a/scripts/compare-actions.sh
+++ b/scripts/compare-actions.sh
@@ -10,7 +10,12 @@ OUTDATED_COUNT=0
 : >actions-outdated.txt
 
 while IFS='|' read -r action current_sha current_tag latest_sha latest_tag; do
-  if [[ "$current_sha" != "$latest_sha" ]]; then
+  # Flag outdated on SHA mismatch OR on tag mismatch when SHAs coincide
+  # (e.g. pin comment says "# v1" but latest release is "v1.0.0" — same
+  # commit today because v1 floats, but the pin label is stale; refresh
+  # it to the exact release name so consumers see what version they're on).
+  if [[ "$current_sha" != "$latest_sha" ]] ||
+    { [[ -n "$current_tag" ]] && [[ -n "$latest_tag" ]] && [[ "$current_tag" != "$latest_tag" ]]; }; then
     echo "  Outdated: ${action} ${current_tag:-unknown} -> ${latest_tag}"
     echo "${action}|${current_sha}|${current_tag}|${latest_sha}|${latest_tag}" >>actions-outdated.txt
     ((OUTDATED_COUNT++)) || true
diff --git a/tests/compare-actions.bats b/tests/compare-actions.bats
index ac29e6f..c719e85 100644
--- a/tests/compare-actions.bats
+++ b/tests/compare-actions.bats
@@ -38,3 +38,40 @@ EOF
   [[ "$output" != *"actions/setup-node"* ]]
   assert_output_contains "has_outdated=true"
 }
+
+@test "compare-actions: flags outdated when SHAs match but tags differ (floating pin behind exact release)" {
+  cat > actions-latest.txt <<EOF
+nerdalytics/check-action-versions|same-sha|v1|same-sha|v1.0.0
+EOF
+
+  run bash "${SCRIPT_DIR}/compare-actions.sh"
+  [ "$status" -eq 0 ]
+  run cat actions-outdated.txt
+  [[ "$output" == *"nerdalytics/check-action-versions|same-sha|v1|same-sha|v1.0.0"* ]]
+  assert_output_contains "has_outdated=true"
+}
+
+@test "compare-actions: up-to-date when both SHAs and tags match exactly" {
+  cat > actions-latest.txt <<EOF
+actions/checkout|same-sha|v5.0.0|same-sha|v5.0.0
+EOF
+
+  run bash "${SCRIPT_DIR}/compare-actions.sh"
+  [ "$status" -eq 0 ]
+  run cat actions-outdated.txt
+  [ -z "$output" ]
+  assert_output_contains "has_outdated=false"
+}
+
+@test "compare-actions: up-to-date when SHAs match and current_tag is empty" {
+  # No comment in the pin -> current_tag is empty. Only SHA comparison matters.
+  cat > actions-latest.txt <<EOF
+actions/checkout|same-sha||same-sha|v5.0.0
+EOF
+
+  run bash "${SCRIPT_DIR}/compare-actions.sh"
+  [ "$status" -eq 0 ]
+  run cat actions-outdated.txt
+  [ -z "$output" ]
+  assert_output_contains "has_outdated=false"
+}