fix: harden GitHub Action version resolution by qartik · Pull Request #3 · qartik/actupdate

qartik · 2026-05-22T21:36:13Z

Summary

keep moving action refs at their published precision, including major-moving tags like v3 and minor-moving tags like v3.4
upgrade exact action refs to the latest eligible stable release without treating semver-equivalent representations as upgrades
resolve each workflow action reference independently instead of reusing one repo-level result across mixed refs
reduce resolver edge cases and API pressure by modeling per-major candidates explicitly and short-circuiting cooldown checks once a higher-priority eligible target is found
strengthen the resolver with targeted regressions, reference-model checks, and property-based tests

Details

actupdate now resolves action tags through an explicit per-major candidate model instead of a sequence of ad hoc helper interactions. For each published major, the resolver distinguishes moving major tags such as v6, moving minor tags such as v6.2, and exact tags such as v6.2.1, then applies one consistent selection policy across upgrade, cooldown, and unchanged paths.

This makes the tool behave correctly for cases such as:

exact same-major upgrades like v3.0 to v3.3
preserving moving minor refs like v3.4 instead of rewriting them to v3.4.1
mixed workflow refs from the same repository without cross-contaminating results
fallback from blocked moving tags to eligible exact tags when appropriate
newer majors that publish only a moving tag
semver-equivalent exact tags such as v3.0 and v3.0.0 without treating them as upgrades

Validation

go test ./...
targeted resolver and CLI regressions for mixed refs, cooldown fallback, moving-only majors, moving minor preservation, and semver-equivalent tags
generated reference-model checks over many candidate-state combinations
property-based tests for resolver invariants using testing/quick

Copilot

Pull request overview

This PR updates actupdate’s resolver and CLI so exact semver action refs (e.g. @v3.0) can be upgraded to newer eligible tags within the same major (e.g. @v3.3), and ensures per-repo resolutions aren’t incorrectly reused across different refs during a single scan.

Changes:

Add ResolveLatestStable to resolve upgrades within the current major and still prefer moving major tags when a newer major is eligible.
Update the CLI scan/report flow to resolve per ref (removing the repo-level resolution reuse that caused incorrect behavior).
Add regression tests covering mixed refs for the same repo (e.g. pypa/cibuildwheel@v3.3 and @v3.0) and same-major upgrade behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates documentation to describe “latest eligible stable version” behavior and moving-tag preference rules.
internal/github/client.go	Introduces `ResolveLatestStable` and same-major exact-tag upgrade detection logic.
internal/github/client_test.go	Adds unit tests for same-major upgrades and behavior with moving tags.
cmd/actupdate/main.go	Switches CLI resolution to `ResolveLatestStable` and removes repo-wide resolution caching across refs.
cmd/actupdate/main_test.go	Adds CLI regression test for mixed refs from the same repo in one workflow file.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

+		if candidates[i].HasMovingMinor {
+			eligible, err := c.tagEligible(ctx, repo, candidates[i].MovingMinor.Original, cutoff)
+			if err != nil {
+				return false, err
+			}
+			candidates[i].MovingMinorEligible = eligible
+			if eligible && !candidates[i].HasMovingMajor {


+- When a newer major exists, moving major tags such as `v6` are preferred over
+  exact tags such as `v6.2.1`


+func candidateFromState(major, state int) (majorCandidates, bool) {
+	candidate := majorCandidates{Major: major}
+	switch state {
+	case 0:
+		return majorCandidates{}, false
+	case 1:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+		candidate.MovingMajorEligible = true
+	case 2:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+	case 3:
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+		candidate.ExactEligible = true
+	case 4:
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+	case 5:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+		candidate.MovingMajorEligible = true
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+		candidate.ExactEligible = true
+	case 6:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+		candidate.ExactEligible = true
+	case 7:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+	case 8:
+		candidate.MovingMajor = mustParseStableVersion(nil, fmt.Sprintf("v%d", major))
+		candidate.HasMovingMajor = true
+		candidate.MovingMajorEligible = true
+		candidate.Exact = mustParseStableVersion(nil, fmt.Sprintf("v%d.2.0", major))
+		candidate.HasExact = true
+	default:
+		panic(fmt.Sprintf("unknown state %d", state))
+	}


+func (s policyScenario) currentVersion() actionspec.StableVersion {
+	if s.CurrentKind {
+		return mustParseStableVersion(nil, fmt.Sprintf("v%d.1.0", s.CurrentMajor))
+	}
+	return mustParseStableVersion(nil, fmt.Sprintf("v%d", s.CurrentMajor))
+}


+	}
+}
+
+func TestResolveLatestStableTreatsEquivalentExactTagsAsUnchanged(t *testing.T) {


qartik · 2026-05-23T22:17:06Z

Superseded by feat: improve stable action resolution #4

fix: upgrade exact action tags within current major

f3b37ca

qartik marked this pull request as ready for review May 22, 2026 21:38

qartik requested a review from Copilot May 22, 2026 21:38

Copilot started reviewing on behalf of qartik May 22, 2026 21:38 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Comment thread internal/github/client.go Outdated

Comment thread internal/github/client.go Outdated

fix: address resolver review edge cases

a870bb5

qartik requested a review from Copilot May 22, 2026 21:49

Copilot started reviewing on behalf of qartik May 22, 2026 21:49 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Comment thread internal/github/client.go Outdated

fix: use exact tags for cooldown fallback

21459ef

qartik requested a review from Copilot May 22, 2026 22:10

Copilot started reviewing on behalf of qartik May 22, 2026 22:10 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Comment thread internal/github/client.go Outdated

Comment thread internal/github/client.go Outdated

refactor: model action version resolution policy

1115de7

qartik changed the title ~~fix: upgrade exact action tags within current major~~ fix: harden action version resolution policy May 22, 2026

test: add property checks for resolver policy

60d700e

qartik changed the title ~~fix: harden action version resolution policy~~ fix: make action version resolution robust May 22, 2026

qartik requested a review from Copilot May 22, 2026 23:38

Copilot started reviewing on behalf of qartik May 22, 2026 23:38 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Comment thread internal/github/client.go

Comment thread internal/github/client.go Outdated

Comment thread internal/github/client_test.go

qartik added 3 commits May 22, 2026 18:46

fix: preserve moving minor action tags

884d18d

fix: ignore semver representation-only upgrades

ff980b7

fix: tighten resolver review follow-ups

15b0862

qartik changed the title ~~fix: make action version resolution robust~~ fix: harden GitHub Action version resolution May 22, 2026

qartik requested a review from Copilot May 22, 2026 23:58

Copilot started reviewing on behalf of qartik May 22, 2026 23:58 View session

Copilot AI reviewed May 23, 2026

View reviewed changes

Comment thread internal/github/client.go Outdated

Comment thread internal/github/client.go

fix: label moving minor upgrades accurately

1ff3f89

qartik requested a review from Copilot May 23, 2026 00:22

Copilot started reviewing on behalf of qartik May 23, 2026 00:22 View session

Copilot AI reviewed May 23, 2026

View reviewed changes

qartik mentioned this pull request May 23, 2026

feat: improve stable action resolution #4

Merged

qartik closed this May 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: harden GitHub Action version resolution#3

fix: harden GitHub Action version resolution#3
qartik wants to merge 9 commits into
mainfrom
codex-fix-same-major-action-updates

qartik commented May 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

qartik commented May 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		- When a newer major exists, moving major tags such as `v6` are preferred over
		exact tags such as `v6.2.1`

Conversation

qartik commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

qartik commented May 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qartik commented May 22, 2026 •

edited

Loading