Record dependency-free workflows in the lockfile (#124)

* Record dependency-free workflows

Dependency resolution failures and workflows without dependencies can both
produce empty dependency slices. Preserve resolver failure state through
planning and pass the existing no-onboard policy to Commit so it can
distinguish these cases before writing new lockfile entries.

This allows dependency-free workflows to receive empty lockfile entries
without adding entries for unresolved or skipped workflows.

* Fix plan test compilation

Remove a duplicate lockfile import and update the stale
newSlowPathFixtures call to match its current signature.

* Add dependency-free workflow tests

Verify that ResolveAllRecursive errors remain available in workflow plans
and that successful partial results are committed.

Cover recording a dependency-free workflow while skipping unresolved
workflows and new workflow entries disabled by the caller.

* Skip rewrites for new workflows

Filter workflows with no existing lockfile entry before the Commit phase rewrites workflow or self-action files when new entries are disabled.

Add a regression test that verifies both source files and the lockfile remain unchanged.

* Test blocking resolver error exclusion

Verify that planning excludes workflow reports marked with a blocking resolver error.

---------

Co-authored-by: Jeff Martin <nodeselector@github.com>

Author: umireon

cmd/gh-actions-lock/run.go

@@ -433,7 +433,7 @@ func runCheck(cmd *cobra.Command, opts *checkOptions, newResolver resolverFunc)
 	// Commit: write all changes to disk atomically (fast local I/O, no
 	// spinner label — it finishes before the user could read one).
 	endCommit := prof.Phase("pin.Commit (disk writes)")
-	if err := pin.Commit(ctx, record, store, nil); err != nil {
+	if err := pin.Commit(ctx, record, store, &pin.CommitOptions{SkipNewWorkflowEntries: noOnboardFlag(cmd)}); err != nil {
 		console.StopProgress()
 		return fmt.Errorf("committing pins: %w", err)
 	}

internal/pin/commit.go

@@ -18,6 +18,8 @@ import (
 type CommitOptions struct {
 	// OnProgress is called at each phase boundary. Nil means no progress.
 	OnProgress func(phase string)
+	// SkipNewWorkflowEntries forces the Commit phase to skip workflows with no existing lockfile entry.
+	SkipNewWorkflowEntries bool
 }
 
 // Commit writes a planned Record to disk: rewrites workflow files and
@@ -29,6 +31,15 @@ func Commit(ctx context.Context, rec *Record, store *lockfile.State, copts *Comm
 	if copts != nil && copts.OnProgress != nil {
 		progress = copts.OnProgress
 	}
+	if copts != nil && copts.SkipNewWorkflowEntries {
+		workflows := rec.Workflows[:0]
+		for _, wp := range rec.Workflows {
+			if store.HasWorkflow(workflowfile.KeyFromPath(wp.Path)) {
+				workflows = append(workflows, wp)
+			}
+		}
+		rec.Workflows = workflows
+	}
 
 	// Phase 1: Rewrite workflow files (uses: line changes).
 	if len(rec.Workflows) > 0 {
@@ -67,9 +78,6 @@ func Commit(ctx context.Context, rec *Record, store *lockfile.State, copts *Comm
 		wfPath := wp.Path
 		wfKey := workflowfile.KeyFromPath(wfPath)
 		deps := pinnedByWorkflow[wfPath]
-		if len(deps) == 0 && !store.HasWorkflow(wfKey) {
-			continue
-		}
 		parentMap := buildParentMap(rec, wfPath)
 		directKeys := buildDirectKeys(rec, wfPath)
 		deps = retainUnresolvablePins(rec, store, wfPath, deps, directKeys)

internal/pin/commit_test.go

@@ -109,6 +109,88 @@ func TestBuildDirectKeys(t *testing.T) {
 	assert.NotContains(t, keys, "g/h@v4", "investigate should be excluded")
 }
 
+func TestCommitDependencyFreeWorkflow(t *testing.T) {
+	tests := []struct {
+		name                   string
+		skipNewWorkflowEntries bool
+		wantEntry              bool
+	}{
+		{"records empty entry", false, true},
+		{"skips onboarding", true, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			workflowPath := filepath.Join(".github", "workflows", "ci.yml")
+			require.NoError(t, os.MkdirAll(filepath.Join(dir, filepath.Dir(workflowPath)), 0o755))
+			require.NoError(t, os.WriteFile(filepath.Join(dir, workflowPath), []byte("on: push\n"), 0o644))
+			t.Chdir(dir)
+
+			store, err := lockfile.LoadState(dir, fakeMeta{})
+			require.NoError(t, err)
+			rec := &Record{Workflows: []WorkflowPlan{{Path: workflowPath}}}
+
+			require.NoError(t, Commit(context.Background(), rec, store, &CommitOptions{SkipNewWorkflowEntries: tt.skipNewWorkflowEntries}))
+			assert.Equal(t, tt.wantEntry, store.HasWorkflow(workflowPath))
+		})
+	}
+}
+
+func TestCommitPartialResolution(t *testing.T) {
+	dir := t.TempDir()
+	workflowPath := filepath.Join(".github", "workflows", "ci.yml")
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, filepath.Dir(workflowPath)), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, workflowPath), []byte("on: push\n"), 0o644))
+	t.Chdir(dir)
+
+	store, err := lockfile.LoadState(dir, fakeMeta{})
+	require.NoError(t, err)
+	rec := &Record{
+		Entries: []Entry{{
+			NWO: "actions/checkout", Ref: "v4", SHA: strings.Repeat("a", 40),
+			Resolution: Pinned, Workflows: []string{workflowPath}, Direct: true,
+		}},
+		Workflows: []WorkflowPlan{{Path: workflowPath}},
+	}
+
+	require.NoError(t, Commit(context.Background(), rec, store, nil))
+	deps, err := store.Get(workflowPath)
+	require.NoError(t, err)
+	assert.Len(t, deps, 1)
+}
+
+func TestCommitSkipNewWorkflowEntriesPreventsRewrites(t *testing.T) {
+	dir := t.TempDir()
+	workflowPath := filepath.Join(".github", "workflows", "ci.yml")
+	actionPath := filepath.Join(".github", "actions", "local", "action.yml")
+	oldUses := "actions/checkout@" + strings.Repeat("a", 40)
+	newUses := "actions/checkout@v4.2.0"
+	workflowContent := []byte("on: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: " + oldUses + "\n")
+	actionContent := []byte("name: local\nruns:\n  using: composite\n  steps:\n    - uses: " + oldUses + "\n")
+	for path, content := range map[string][]byte{workflowPath: workflowContent, actionPath: actionContent} {
+		require.NoError(t, os.MkdirAll(filepath.Join(dir, filepath.Dir(path)), 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(dir, path), content, 0o644))
+	}
+	t.Chdir(dir)
+
+	store, err := lockfile.LoadState(dir, fakeMeta{})
+	require.NoError(t, err)
+	rec := &Record{Workflows: []WorkflowPlan{{
+		Path:            workflowPath,
+		Rewrites:        map[string]string{oldUses: newUses},
+		SelfActionFiles: []string{actionPath},
+	}}}
+
+	require.NoError(t, Commit(context.Background(), rec, store, &CommitOptions{SkipNewWorkflowEntries: true}))
+	workflowAfter, err := os.ReadFile(workflowPath)
+	require.NoError(t, err)
+	actionAfter, err := os.ReadFile(actionPath)
+	require.NoError(t, err)
+	assert.Equal(t, workflowContent, workflowAfter)
+	assert.Equal(t, actionContent, actionAfter)
+	assert.False(t, store.HasWorkflow(workflowPath))
+}
+
 func TestCommitRemovesDependenciesDroppedFromWorkflow(t *testing.T) {
 	dir := t.TempDir()
 	workflowPath := filepath.Join(".github", "workflows", "ci.yml")

internal/pin/plan.go

@@ -135,7 +135,7 @@ type planResult struct {
 func planWorkflow(ctx context.Context, wr checks.WorkflowReport, opts PlanOptions, status func(string)) (planResult, error) {
 	var entries []Entry
 	var wplans []WorkflowPlan
-	if wr.SkipCommit {
+	if wr.SkipCommit || wr.BlockingResolverError {
 		return planResult{entries: verifiedEntries(wr.Inventory, wr.Path)}, nil
 	}
 	for _, finding := range wr.Findings {

internal/pin/plan_test.go

@@ -592,6 +592,18 @@ func TestPlanExcludesLoadFailuresFromCommit(t *testing.T) {
 	assert.Equal(t, blocked.Path, record.Entries[0].Workflows[0])
 }
 
+func TestPlanExcludesBlockingResolverErrorsFromCommit(t *testing.T) {
+	record, err := Plan(context.Background(), &checks.Report{
+		Workflows: []checks.WorkflowReport{{
+			Path:                  ".github/workflows/ci.yml",
+			BlockingResolverError: true,
+		}},
+	}, PlanOptions{Pool: pinpool.New(2, nil)})
+	require.NoError(t, err)
+
+	assert.Empty(t, record.Workflows)
+}
+
 func TestPlanWorkflow_SelfRepositoryDependencyIsNotRewrittenOnFastPath(t *testing.T) {
 	const sha = "abc1230000000000000000000000000000000000"
 

internal/pipeline/checks/finding.go

@@ -65,6 +65,8 @@ type WorkflowReport struct {
 	Findings []Finding
 	// SkipCommit prevents terminal parse failures from entering the write phase.
 	SkipCommit bool
+	// BlockingResolverError indicates that diagnosis classified a resolver error as blocking.
+	BlockingResolverError bool
 	// ActionRefs are all remote dependency roots attributed to the workflow,
 	// including refs found inside in-repo `$/…` actions.
 	ActionRefs []parserlock.ActionRef

internal/pipeline/diagnose.go

@@ -102,6 +102,7 @@ func diagnoseOneParsed(ctx context.Context, pw checks.ParsedWorkflow, r *resolve
 				blockingResolverError = true
 			}
 			if blockingResolverError {
+				wr.BlockingResolverError = true
 				return wr
 			}
 			// Low: we're surfacing the resolver failure itself, not a