Rewrite transferred action references to canonical repositories

cmd/gh-actions-lock/format/terminal.go

@@ -121,7 +121,7 @@ func PresentReadOnlyFailures(out *ui.UI, report *checks.Report) (hasFixable bool
 		g := groups[key]
 		out.TermBlank()
 		for _, f := range g.findings {
-			if IsAutoFixable(f.Category) {
+			if IsAutoFixable(f) {
 				hasFixable = true
 			}
 			renderTermFindingDetail(out, f, key)
@@ -436,8 +436,11 @@ func IsAlertedCategory(c checks.Category) bool {
 // (unreachable-pin, misleading-sha) need investigation or --accept-moved, and
 // local-path actions aren't supported at all — so none of those should
 // trigger the "Re-run without --no-fix to apply fixes" hint.
-func IsAutoFixable(c checks.Category) bool {
-	switch c {
+func IsAutoFixable(f checks.Finding) bool {
+	if f.Category == checks.RefChanged && f.ParentNWO != "" {
+		return false
+	}
+	switch f.Category {
 	case checks.NotPinned, checks.RefChanged, checks.Stale:
 		return true
 	}

cmd/gh-actions-lock/format/terminal_test.go

@@ -609,6 +609,18 @@ func TestPresentReadOnlyFailures_FixableReported(t *testing.T) {
 	}
 }
 
+func TestTransferredRepositoryAutoFixableOnlyWhenWritable(t *testing.T) {
+	direct := checks.Finding{Category: checks.RefChanged}
+	remote := checks.Finding{Category: checks.RefChanged, ParentNWO: "root/composite@v2"}
+
+	if !IsAutoFixable(direct) {
+		t.Fatal("direct transfer should be auto-fixable")
+	}
+	if IsAutoFixable(remote) {
+		t.Fatal("remote transfer should not be auto-fixable")
+	}
+}
+
 // TestPresentReadOnlyFailures_ValidReportSilent verifies a clean report
 // produces no output and reports nothing fixable.
 func TestPresentReadOnlyFailures_ValidReportSilent(t *testing.T) {

cmd/gh-actions-lock/run.go

@@ -176,18 +176,9 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 	if err != nil {
 		return err
 	}
-	// Pre-warm resolver caches from the lockfile so repeat runs skip
-	// redundant GraphQL and REST calls. Skipped when --rescan is set:
-	// a full re-verification must hit the network to detect ref movement.
-	// --accept-moved and --relock both imply --rescan (must detect what
-	// moved before re-pinning).
 	if opts.acceptMoved || opts.relock {
 		opts.rescan = true
 	}
-	trustLockfileCaches := !opts.rescan
-	if trustLockfileCaches {
-		r.SeedFromLockfile(store.AllDeps())
-	}
 	endSetup()
 
 	opts.workflowPaths = paths

internal/dep/dependency.go

@@ -15,7 +15,8 @@ import (
 // resolver traversal, and lockfile serialization — never persisted on disk
 // and not part of any public API.
 type Dependency struct {
-	NWO string // owner/repo (no path)
+	NWO          string // owner/repo (no path)
+	OriginalRefs []parserlock.ActionRef
 	// Path is the optional sub-action subpath as written in `uses:`
 	// (e.g. "save" for actions/cache/save). It is preserved on the
 	// in-memory dep so resolver-time graph traversal can fetch the
@@ -75,14 +76,32 @@ func detectHashAlgo(hash string) string {
 	return "sha1"
 }
 
-// Dedup returns a copy of deps with duplicates (by Key) removed,
-// preserving first-seen order.
+// Dedup returns a copy of deps with duplicates (by Key) removed, preserving
+// first-seen order. A redirected result replaces a seeded result because it
+// carries the live repository identity, SHA, and action metadata.
 func Dedup(deps []Dependency) []Dependency {
-	seen := make(map[string]bool, len(deps))
+	seen := make(map[string]int, len(deps))
 	out := make([]Dependency, 0, len(deps))
 	for _, d := range deps {
-		if k := d.Key(); !seen[k] {
-			seen[k] = true
+		k := d.Key()
+		if idx, ok := seen[k]; ok {
+			if len(out[idx].OriginalRefs) == 0 && len(d.OriginalRefs) > 0 {
+				out[idx] = d
+				continue
+			}
+			have := make(map[string]bool, len(out[idx].OriginalRefs))
+			for _, ref := range out[idx].OriginalRefs {
+				have[ref.FullName()+"@"+ref.Ref] = true
+			}
+			for _, ref := range d.OriginalRefs {
+				refKey := ref.FullName() + "@" + ref.Ref
+				if !have[refKey] {
+					out[idx].OriginalRefs = append(out[idx].OriginalRefs, ref)
+					have[refKey] = true
+				}
+			}
+		} else {
+			seen[k] = len(out)
 			out = append(out, d)
 		}
 	}

internal/dep/dependency_test.go

@@ -3,7 +3,9 @@ package dep
 import (
 	"testing"
 
+	parserlock "github.com/github/actions-lockfile/go/pkg/lockfile"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDependencyStringRoundTrip(t *testing.T) {
@@ -54,3 +56,39 @@ func TestDependencyKey(t *testing.T) {
 	d := Dependency{NWO: "actions/checkout", Ref: "v4", SHA: "abc"}
 	assert.Equal(t, "actions/checkout@v4", d.Key())
 }
+
+func TestDedupMergesTransferredSources(t *testing.T) {
+	live := Dependency{
+		NWO:  "new/action",
+		Ref:  "v1",
+		SHA:  "live",
+		Path: "live-path",
+		OriginalRefs: []parserlock.ActionRef{
+			{Owner: "old", Repo: "action", Ref: "v1"},
+		},
+	}
+	seeded := Dependency{NWO: "new/action", Ref: "v1", SHA: "seeded"}
+	for _, tt := range []struct {
+		name string
+		deps []Dependency
+	}{
+		{
+			name: "seeded before live redirect",
+			deps: []Dependency{seeded, live},
+		},
+		{
+			name: "live redirect before seeded",
+			deps: []Dependency{live, seeded},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			got := Dedup(tt.deps)
+
+			require.Len(t, got, 1)
+			assert.Equal(t, "live", got[0].SHA)
+			assert.Equal(t, "live-path", got[0].Path)
+			require.Len(t, got[0].OriginalRefs, 1)
+			assert.Equal(t, "old/action", got[0].OriginalRefs[0].NWO())
+		})
+	}
+}

internal/ghapi/graphql_action_files.go

@@ -27,13 +27,14 @@ func (r ActionFileRequest) NWO() string { return r.Owner + "/" + r.Repo }
 // for one ActionFileRequest. Err is non-nil when this specific ref could
 // not be resolved (e.g. not found, SSO required).
 type ActionFileResult struct {
-	Owner     string
-	Repo      string
-	Path      string
-	Ref       string
-	CommitOID string
-	ActionYML string
-	Err       error
+	Owner       string
+	Repo        string
+	OriginalNWO string
+	Path        string
+	Ref         string
+	CommitOID   string
+	ActionYML   string
+	Err         error
 }
 
 // repoResponse is the raw GraphQL response shape for a single repository alias.
@@ -260,6 +261,12 @@ func parseActionFileResponse(data map[string]json.RawMessage, refs []ActionFileR
 			results[idx].Err = fmt.Errorf("failed to parse: %w", err)
 			continue
 		}
+		if repo.NameWithOwner != "" {
+			if err := canonicalizeActionFileResult(&results[idx], ref, repo.NameWithOwner); err != nil {
+				results[idx].Err = err
+				continue
+			}
+		}
 
 		if repo.Object == nil || repo.Object.OID == "" {
 			n := len(ref.Ref)
@@ -289,6 +296,20 @@ func parseActionFileResponse(data map[string]json.RawMessage, refs []ActionFileR
 	return results
 }
 
+func canonicalizeActionFileResult(result *ActionFileResult, ref ActionFileRequest, canonical string) error {
+	owner, name, ok := strings.Cut(canonical, "/")
+	if !ok || owner == "" || name == "" {
+		return fmt.Errorf("invalid canonical repository name %q", canonical)
+	}
+	if strings.EqualFold(canonical, ref.NWO()) {
+		return nil
+	}
+	result.OriginalNWO = ref.NWO()
+	result.Owner = owner
+	result.Repo = name
+	return nil
+}
+
 // samlBlockedOwners returns the set of repository owners whose resolution
 // failed an organization SAML SSO enforcement check.
 func samlBlockedOwners(gqlErr *api.GraphQLError, refs []ActionFileRequest, aliasMap map[string]int) map[string]bool {

internal/ghapi/graphql_action_files_test.go

@@ -101,6 +101,30 @@ func TestParseActionFileResponse_AnnotatedTagPeeled(t *testing.T) {
 	}
 }
 
+func TestParseActionFileResponse_CanonicalizesMovedRepository(t *testing.T) {
+	refs := []ActionFileRequest{{
+		Owner: "krzema12", Repo: "github-actions-typing", Ref: "v2.2.2",
+	}}
+	data := map[string]json.RawMessage{
+		"a0": json.RawMessage(`{"nameWithOwner":"typesafegithub/github-actions-typing","object":{"oid":"9ddf35b71a482be7d8922b28e8d00df16b77e315"}}`),
+	}
+
+	results := parseActionFileResponse(data, refs, map[string]int{"a0": 0}, nil, "")
+
+	if results[0].Err != nil {
+		t.Fatalf("unexpected error: %v", results[0].Err)
+	}
+	if results[0].OriginalNWO != "krzema12/github-actions-typing" {
+		t.Fatalf("original repository = %q", results[0].OriginalNWO)
+	}
+	if got := results[0].Owner + "/" + results[0].Repo; got != "typesafegithub/github-actions-typing" {
+		t.Fatalf("canonical repository = %q", got)
+	}
+	if results[0].CommitOID != "9ddf35b71a482be7d8922b28e8d00df16b77e315" {
+		t.Fatalf("commit = %q", results[0].CommitOID)
+	}
+}
+
 func TestParseActionFileResponse_Errors(t *testing.T) {
 	refs := []ActionFileRequest{
 		{Owner: "actions", Repo: "checkout", Ref: "v6"},

internal/ghapi/repos.go

@@ -126,6 +126,7 @@ func (c *Client) ListTags(ctx context.Context, owner, repo string) ([]TagEntry,
 // branch, the numeric owner and repo IDs (lockfile write), and the visibility
 // and last-push time (tag freshness/immutability checks).
 type repoMeta struct {
+	NameWithOwner string
 	DefaultBranch string
 	OwnerID       int64
 	RepoID        int64
@@ -134,9 +135,10 @@ type repoMeta struct {
 }
 
 // repoMetadata fetches repos/{owner}/{repo} at most once per run, coalescing
-// concurrent callers via singleflight and caching the result. GetDefaultBranch,
-// RepoIDs, and RepoMetadata all derive from it, so a repo costs one round-trip
-// instead of one per consumer. The request runs under a cancel-free context:
+// concurrent callers via singleflight and caching the result. CanonicalNWO,
+// GetDefaultBranch, RepoIDs, and RepoMetadata all derive from it, so a repo
+// costs one round-trip instead of one per consumer. The request runs under a
+// cancel-free context:
 // callers fan out under scan/errgroup contexts that cancel on first
 // match/error, and a coalesced caller's cancellation must not abort the shared
 // fetch for the others waiting on it.
@@ -150,6 +152,7 @@ func (c *Client) repoMetadata(ctx context.Context, owner, repo string) (repoMeta
 			return m, nil
 		}
 		var resp struct {
+			FullName      string `json:"full_name"`
 			DefaultBranch string `json:"default_branch"`
 			Visibility    string `json:"visibility"`
 			PushedAt      string `json:"pushed_at"`
@@ -169,6 +172,7 @@ func (c *Client) repoMetadata(ctx context.Context, owner, repo string) (repoMeta
 			}
 		}
 		m := repoMeta{
+			NameWithOwner: resp.FullName,
 			DefaultBranch: resp.DefaultBranch,
 			OwnerID:       resp.Owner.ID,
 			RepoID:        resp.ID,
@@ -184,6 +188,15 @@ func (c *Client) repoMetadata(ctx context.Context, owner, repo string) (repoMeta
 	return v.(repoMeta), nil
 }
 
+// CanonicalNWO returns the repository's current owner/name.
+func (c *Client) CanonicalNWO(ctx context.Context, owner, repo string) (string, error) {
+	m, err := c.repoMetadata(ctx, owner, repo)
+	if err != nil {
+		return "", err
+	}
+	return m.NameWithOwner, nil
+}
+
 // GetDefaultBranch returns the repo's default branch name (e.g. "main"), or
 // "" if the lookup fails. Backed by the shared repoMetadata fetch.
 func (c *Client) GetDefaultBranch(ctx context.Context, owner, repo string) string {

internal/ghapi/repos_dedup_test.go

@@ -60,6 +60,7 @@ func (t *countingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		})(req)
 	default: // repos/{owner}/{repo}
 		return httpmock.JSONResponse(map[string]any{
+			"full_name":      "o/r",
 			"default_branch": "main",
 			"id":             int64(20),
 			"owner":          map[string]any{"id": int64(10)},
@@ -141,8 +142,8 @@ func TestRepoIDs_CoalescesConcurrent(t *testing.T) {
 	}
 }
 
-// RepoIDs and GetDefaultBranch both derive from repos/{owner}/{repo}; they
-// must share a single round-trip rather than fetching it twice.
+// Repository metadata consumers must share a single round-trip rather than
+// fetching it once per field.
 func TestRepoMetadata_SharedAcrossConsumers(t *testing.T) {
 	tr := newCountingTransport(2 * time.Millisecond)
 	c := newCountingClient(t, tr)
@@ -154,6 +155,9 @@ func TestRepoMetadata_SharedAcrossConsumers(t *testing.T) {
 		if owner, repo, err := c.RepoIDs(context.Background(), "o", "r"); err != nil || owner != 10 || repo != 20 {
 			t.Errorf("RepoIDs = (%d, %d, %v)", owner, repo, err)
 		}
+		if nwo, err := c.CanonicalNWO(context.Background(), "o", "r"); err != nil || nwo != "o/r" {
+			t.Errorf("CanonicalNWO = (%q, %v)", nwo, err)
+		}
 	})
 
 	if n := tr.count("repos/o/r"); n != 1 {

internal/ghapi/rest_fallback.go

@@ -252,13 +252,37 @@ func (c *Client) resolveAnonymous(ctx context.Context, ref ActionFileRequest) Ac
 		Ref:   ref.Ref,
 	}
 
+	var canonical string
+	if c.restOnly {
+		var metadata struct {
+			FullName string `json:"full_name"`
+		}
+		path := fmt.Sprintf("repos/%s/%s", url.PathEscape(ref.Owner), url.PathEscape(ref.Repo))
+		if err := c.anonGet(ctx, path, &metadata); err != nil {
+			result.Err = fmt.Errorf("anonymous fallback: %w", err)
+			return result
+		}
+		canonical = metadata.FullName
+	} else {
+		metadata, err := c.repoMetadata(ctx, ref.Owner, ref.Repo)
+		if err != nil {
+			result.Err = fmt.Errorf("anonymous fallback: %w", err)
+			return result
+		}
+		canonical = metadata.NameWithOwner
+	}
+	if err := canonicalizeActionFileResult(&result, ref, canonical); err != nil {
+		result.Err = err
+		return result
+	}
+
 	base := c.anonBase()
 
 	// Resolve ref → commit SHA via the commits endpoint.
 	commitURL := fmt.Sprintf("%s/repos/%s/%s/commits/%s",
 		base,
-		url.PathEscape(ref.Owner),
-		url.PathEscape(ref.Repo),
+		url.PathEscape(result.Owner),
+		url.PathEscape(result.Repo),
 		url.PathEscape(ref.Ref),
 	)
 	sha, err := c.anonGetCommitSHA(ctx, commitURL)
@@ -276,10 +300,10 @@ func (c *Client) resolveAnonymous(ctx context.Context, ref ActionFileRequest) Ac
 		yamlPath = ref.Path + "/action.yaml"
 	}
 
-	content, err := c.anonGetFileContent(ctx, base, ref.Owner, ref.Repo, sha, ymlPath)
+	content, err := c.anonGetFileContent(ctx, base, result.Owner, result.Repo, sha, ymlPath)
 	if err != nil {
 		// Try .yaml extension.
-		content, err = c.anonGetFileContent(ctx, base, ref.Owner, ref.Repo, sha, yamlPath)
+		content, err = c.anonGetFileContent(ctx, base, result.Owner, result.Repo, sha, yamlPath)
 		if err != nil {
 			// Not fatal — some actions don't have action.yml (reusable workflows).
 			return result