Only rewrite action refs to tags at the resolved commit

[nodeselector]

What

Only rewrite action refs to tags that point exactly at the resolved commit.

Why

Ancestor tags do not contain descendant commits. Rewriting a ref to an ancestor tag while retaining the newer resolved commit creates an incoherent lock entry that immediately fails verification.

This affected both:

• dawidd6/action-download-artifact@<SHA>, which became @v3.1.4 while retaining the newer v21 commit.
• dawidd6/action-send-mail@v18, which could become the unrelated ancestor @v3.12.0.

Fixes#109
Fixes#113

How

• Remove ancestor-tag fallback from automatic narrowing and verified-entry updates.
• Let existing reverse lookup normalize bare SHAs to exact tags, including major-only tags such as v21, or to a containing branch.
• Keep symbolic v4 and v4.2 narrowing limited to exact same-commit full tags in the requested family.

Testing

• go test ./...
• Command regression updates the issue Strange behaviour when running the command #109 SHA to v21 while a valid ancestor alternative exists, checks lock ref/commit coherence, then runs --verify-local.
• Command regression changes an existing v3.12.0 lock entry to workflow ref v18 at the same commit, checks rekey and stale-entry garbage collection, then runs --verify-local.

[Copilot]

Copilot review overview

🟡 Changes recommended

Exact-SHA tag lookup still bypasses the family restriction and can reproduce issue #113.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	internal/​tag/​tags_test.go — These mocks only register compare responses for candidates expected to be accepted. Because…
	internal/​tag/​tagging.go — The family restriction is applied only in the ancestor fallback, but every narrowing path first…

What changed in this PR

Restricts ancestor-tag fallback to the requested semantic-version family.

Changes:

• Filters ancestor tags by major or minor family.
• Preserves unrestricted fallback for bare SHAs.
• Adds family-selection unit tests.

File	Description
internal/​tag/​tagging.go	Adds family-aware ancestor filtering.
internal/​pin/​plan.go	Passes original refs into ancestor lookup.
internal/​tag/​tags_test.go	Tests family filtering behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Regression coverage does not fully reproduce the ancestor relationship or issue #113’s required update flow.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	cmd/​gh-actions-lock/​command_test.go — The fixture labels v3.1.4 with ancestorSHA but never makes the Compare API report that it is an…
	internal/​pin/​plan_test.go — This helper-level test does not cover issue #113's acceptance path: an existing vOld lock entry,…

Issues resolved since last review (2)

Severity	Finding
	internal/​tag/​tagging.go — The family restriction is applied only in the ancestor fallback, but every narrowing path first… View resolved comment
	internal/​tag/​tags_test.go — These mocks only register compare responses for candidates expected to be accepted. Because… View resolved comment

[Copilot]

Copilot review overview

🟡 Changes recommended

NWO-wide narrowing state can prevent a bare SHA from being normalized when another ref for the same repository is narrowed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	internal/​pin/​plan.go — Delegating bare SHAs to ReverseLookup breaks normalization when the workflow also uses the same…

Issues resolved since last review (2)

Severity	Finding
	internal/​pin/​plan_test.go — This helper-level test does not cover issue #113's acceptance path: an existing vOld lock entry,… View resolved comment
	cmd/​gh-actions-lock/​command_test.go — The fixture labels v3.1.4 with ancestorSHA but never makes the Compare API report that it is an… View resolved comment

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

internal/pin/plan.go:350

• The preceding comment is now stale: this branch no longer finds a tag; it only preserves a SHA under --no-narrow, while exact-tag or branch selection happens later in ReverseLookup.

 continue

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the stated requirements and includes focused unit and command-level regression coverage.

Review tier: Balanced
Findings: None

Issues resolved since last review (1)

Severity	Finding
	internal/​pin/​plan.go — Delegating bare SHAs to ReverseLookup breaks normalization when the workflow also uses the same… View resolved comment

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation consistently enforces ref/commit coherence and includes focused regression coverage.

Review tier: Balanced
Findings: None