Resolve --gh-aw-ref branch/tag to commit SHA at compile time

[dsyme]

PR #38689 — Resolve --gh-aw-ref branch/tag to commit SHA at compile time

Summary

Ensures that when a branch or tag name is supplied via --gh-aw-ref, it is resolved to a full 40-character immutable commit SHA at compile time (before the value is used as actionTag). Previously, a mutable ref such as a branch name could be embedded into the compiled workflow, making the resulting artifact non-deterministic. After this change the compiled output always pins to an exact SHA.

---

What changed

Area	File	Change
CLI entry-point	cmd/gh-aw/main.go	Calls workflow.ResolveGhAwRef in the compile command handler; resolves the --gh-aw-ref value to a full SHA before it is stored as actionTag. Updates the flag's help text to reflect SHA resolution.
Workflow package	pkg/workflow/action_resolver.go	New exported function ResolveGhAwRef: queries the GitHub API for the given ref in the github/gh-aw repository and returns its full SHA. Short-circuits if the input is already a valid 40-char SHA (no API call needed).
Documentation	DEVGUIDE.md	Clarifies that branch/tag names are resolved to an immutable commit SHA at compile time; updates the action reference format example from <REF> to <SHA>.

---

Motivation

Embedding a branch name (e.g. main) or a tag name into a compiled workflow means the reference can move between compile time and execution time, breaking reproducibility and auditability. Resolving to a SHA at compile time:

• Guarantees the compiled artifact is fully pinned and reproducible.
• Prevents silent drift if the upstream branch or tag is updated.
• Aligns with supply-chain best practices for action references.

---

Behaviour details

• Already-a-SHA fast path: ResolveGhAwRef checks whether the input is already a 40-hex-char SHA; if so it returns it immediately without making an API call.
• GitHub API lookup: For any other value (branch name, tag name, short ref) the function calls the GitHub API against the github/gh-aw repository to resolve it.
• No breaking changes: The flag interface is unchanged; only the internal representation of the resolved value differs (SHA instead of a possibly-mutable ref string).

---

Risk & impact

Dimension	Assessment
Breaking change	No
API calls added	One GitHub API call per compile invocation when --gh-aw-ref is a non-SHA ref (zero calls if already a SHA)
Affected commands	gh aw compile only
Test surface	pkg/workflow/action_resolver.go (new exported function); cmd/gh-aw/main.go compile handler

---

Commits

SHA	Message
f1f2cccda	Resolve --gh-aw-ref branch/tag to commit SHA at compile time
85a218061	Merge branch 'main' into resolve-gh-aw-ref-to-sha
70b0f6124	Potential fix for pull request finding

Generated by PR Description Updater for issue #38689 · 97.1 AIC · ⌖ 13.1 AIC · ⊞ 19.8K · ◷

[Copilot]

Pull request overview

This pull request makes gh aw compile --gh-aw-ref <BRANCH|TAG> resolve the provided ref to an immutable 40-character commit SHA at compile time, preventing compiled .lock.yml files from silently drifting as branches move or tags are recreated.

Changes:

• Added workflow.ResolveGhAwRef(ctx, ref) to resolve branch/tag refs to full commit SHAs (skipping resolution when already given a full SHA).
• Updated the compile command’s --gh-aw-ref handling to resolve early and fail fast on resolution errors.
• Updated DEVGUIDE.md and CLI flag help text to document SHA-resolution behavior.

Show a summary per file

File	Description
pkg/workflow/action_resolver.go	Adds ResolveGhAwRef to resolve github/gh-aw refs to full SHAs via gh api.
cmd/gh-aw/main.go	Uses ResolveGhAwRef when --gh-aw-ref is provided; updates help text accordingly.
DEVGUIDE.md	Documents that branch/tag refs are resolved to SHAs at compile time for immutability.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 3

[github-actions]

@copilot review all comments and address unresolved review feedback. Please refresh the branch and rerun checks once that is done.

Generated by 👨‍🍳 PR Sous Chef · 65.7 AIC · ⌖ 1.82 AIC · ⊞ 17.3K · ◷

[github-actions]

@copilot review all comments and address unresolved review feedback.

Generated by 👨‍🍳 PR Sous Chef · 42.5 AIC · ⌖ 1.06 AIC · ⊞ 17.3K · ◷

[github-actions]

Please rerun checks after the branch refresh and summarize any remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 42.5 AIC · ⌖ 1.06 AIC · ⊞ 17.3K · ◷

[github-actions]

``
@copilot review all comments and address unresolved review feedback.

Generated by 👨‍🍳 PR Sous Chef · 28.5 AIC · ⌖ 1.01 AIC · ⊞ 17.3K · ◷

[github-actions]

``
Please refresh the branch, re-run checks, and summarize any remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 28.5 AIC · ⌖ 1.01 AIC · ⊞ 17.3K · ◷

[github-actions]

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (27393440896)

Generated by 🧪 Smoke CI for issue #38689 · ◷