Refactor action pin warnings and agentdrain helpers

pkg/actionpins/actionpins_internal_test.go

@@ -163,25 +163,20 @@ func TestFormatPinnedActionReference_PanicsWhenSHAIsEmpty(t *testing.T) {
 		}, "Expected FormatPinnedActionReference to panic with specific message when SHA is empty")
 }
 
-func TestInitWarnings_InitializesAndPreservesMap(t *testing.T) {
-	t.Parallel()
-	t.Run("initializes nil warnings map", func(t *testing.T) {
-		ctx := &PinContext{}
-
-		initWarnings(ctx)
+func TestPinContextEmitOnce_InitializesAndDeduplicates(t *testing.T) {
+	ctx := &PinContext{}
 
-		require.NotNil(t, ctx.Warnings, "Expected warnings map to be initialized")
-		assert.Empty(t, ctx.Warnings, "Expected initialized warnings map to be empty")
+	stderrOutput := testutil.CaptureStderr(t, func() {
+		ctx.emitOnce("new", "first", func(message string) string {
+			return "formatted: " + message
+		})
+		ctx.emitOnce("new", "second", func(message string) string {
+			return "formatted: " + message
+		})
 	})
 
-	t.Run("preserves existing warnings map", func(t *testing.T) {
-		ctx := &PinContext{Warnings: map[string]bool{"actions/checkout@v5": true}}
-
-		initWarnings(ctx)
-
-		require.NotNil(t, ctx.Warnings, "Expected warnings map to remain initialized")
-		assert.Equal(t, map[string]bool{"actions/checkout@v5": true}, ctx.Warnings, "Expected existing warnings to be preserved unchanged")
-	})
+	assert.Equal(t, map[string]bool{"new": true}, ctx.Warnings)
+	assert.Equal(t, "formatted: first\n", stderrOutput)
 }
 
 func TestFormatPinnedActionWithResolution_ConsistentVersionComment(t *testing.T) {
@@ -939,9 +934,26 @@ func TestApplyContainerPinMapping(t *testing.T) {
 						mapNotifications++
 					}
 				}
+
 				assert.Equal(t, tt.wantMapNotificationKeys, mapNotifications,
 					"number of container-map: warning keys should match")
 			}
 		})
 	}
 }
+
+func TestApplyContainerPinMapping_DeduplicatesInvalidWarnings(t *testing.T) {
+	ctx := &PinContext{
+		ContainerMappings: map[string]string{
+			"ghcr.io/owner/image:latest": "registry.acme.com/image:latest",
+		},
+	}
+
+	stderrOutput := testutil.CaptureStderr(t, func() {
+		ApplyContainerPinMapping("ghcr.io/owner/image:latest", ctx)
+		ApplyContainerPinMapping("ghcr.io/owner/image:latest", ctx)
+	})
+
+	assert.Equal(t, 1, strings.Count(stderrOutput, "invalid replacement value"))
+	assert.True(t, ctx.Warnings["container-invalid:ghcr.io/owner/image:latest"])
+}

pkg/actionpins/data.go

@@ -0,0 +1,150 @@
+package actionpins
+
+import (
+	"cmp"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/github/gh-aw/pkg/logger"
+	"github.com/github/gh-aw/pkg/semverutil"
+)
+
+var actionPinsLog = logger.New("actionpins:actionpins")
+
+//go:embed data/action_pins.json
+var actionPinsJSON []byte
+
+var (
+	cachedActionPins       []ActionPin
+	cachedActionPinsByRepo map[string][]ActionPin
+	cachedContainerPins    map[string]ContainerPin
+	actionPinsOnce         sync.Once
+)
+
+func getActionPins() []ActionPin {
+	actionPinsOnce.Do(func() {
+		actionPinsLog.Print("Unmarshaling action pins from embedded JSON (first call, will be cached)")
+
+		data := loadActionPinsData(actionPinsJSON)
+
+		pins := slices.Collect(maps.Values(data.Entries))
+
+		slices.SortFunc(pins, func(a, b ActionPin) int {
+			if a.Version != b.Version {
+				return cmp.Compare(b.Version, a.Version) // descending by version
+			}
+			return cmp.Compare(a.Repo, b.Repo)
+		})
+
+		actionPinsLog.Printf("Successfully unmarshaled and sorted %d action pins from JSON", len(pins))
+		cachedActionPins = pins
+
+		cachedActionPinsByRepo = buildByRepoIndex(pins)
+		actionPinsLog.Printf("Built per-repo action pin index for %d repos", len(cachedActionPinsByRepo))
+
+		cachedContainerPins = data.Containers
+		if cachedContainerPins == nil {
+			cachedContainerPins = make(map[string]ContainerPin)
+		}
+		actionPinsLog.Printf("Loaded %d container pins from JSON", len(cachedContainerPins))
+	})
+
+	return cachedActionPins
+}
+
+// loadActionPinsData unmarshals embedded action pin data.
+// Panics if the embedded JSON is invalid or any entry has an empty SHA, because
+// those conditions indicate corrupted release data that would produce invalid workflow YAML.
+func loadActionPinsData(raw []byte) ActionPinsData {
+	var data ActionPinsData
+	if err := json.Unmarshal(raw, &data); err != nil {
+		actionPinsLog.Printf("Failed to unmarshal action pins JSON: %v", err)
+		panic(fmt.Sprintf("failed to load action pins: %v", err))
+	}
+
+	if n := countPinKeyMismatches(data.Entries); n > 0 {
+		actionPinsLog.Printf("Found %d key/version mismatches in action_pins.json", n)
+	}
+
+	if emptyKeys := collectEntriesWithEmptySHA(data.Entries); len(emptyKeys) > 0 {
+		panic(fmt.Sprintf("action_pins.json has %d entries with empty SHA %v — these would produce invalid workflow YAML (e.g. 'owner/repo@ # version'); remove or fix these entries before releasing", len(emptyKeys), emptyKeys))
+	}
+
+	return data
+}
+
+// countPinKeyMismatches returns the number of entries where the key version does not
+// match pin.Version, logging each mismatch for diagnostics.
+func countPinKeyMismatches(entries map[string]ActionPin) int {
+	count := 0
+	for key, pin := range entries {
+		if idx := strings.LastIndex(key, "@"); idx != -1 {
+			keyVersion := key[idx+1:]
+			if keyVersion != pin.Version {
+				count++
+				shortSHA := pin.SHA[:min(len(pin.SHA), 8)]
+				actionPinsLog.Printf("WARNING: Key/version mismatch in action_pins.json: key=%s has version=%s but pin.Version=%s (sha=%s)",
+					key, keyVersion, pin.Version, shortSHA)
+			}
+		}
+	}
+	return count
+}
+
+// collectEntriesWithEmptySHA returns the keys of entries whose SHA field is empty,
+// logging each offending entry for diagnostics.
+func collectEntriesWithEmptySHA(entries map[string]ActionPin) []string {
+	var keys []string
+	for key, pin := range entries {
+		if pin.SHA == "" {
+			keys = append(keys, key)
+			actionPinsLog.Printf("ERROR: Empty SHA in action_pins.json: key=%s repo=%s version=%s", key, pin.Repo, pin.Version)
+		}
+	}
+	slices.Sort(keys)
+	return keys
+}
+
+// buildByRepoIndex groups pins by repository and sorts each group by version descending.
+func buildByRepoIndex(pins []ActionPin) map[string][]ActionPin {
+	byRepo := make(map[string][]ActionPin, len(pins))
+	for _, pin := range pins {
+		byRepo[pin.Repo] = append(byRepo[pin.Repo], pin)
+	}
+	for _, repoPins := range byRepo {
+		slices.SortFunc(repoPins, func(a, b ActionPin) int {
+			v1 := strings.TrimPrefix(a.Version, "v")
+			v2 := strings.TrimPrefix(b.Version, "v")
+			return semverutil.Compare(v2, v1) // descending by semver
+		})
+	}
+	return byRepo
+}
+
+// GetActionPinsByRepo returns the sorted (version-descending) list of action pins
+// for the given repository. Returns nil if the repo has no pins.
+func GetActionPinsByRepo(repo string) []ActionPin {
+	getActionPins()
+	return cachedActionPinsByRepo[repo]
+}
+
+// GetLatestActionPinByRepo returns the latest ActionPin for a given repository, if any.
+func GetLatestActionPinByRepo(repo string) (ActionPin, bool) {
+	pins := GetActionPinsByRepo(repo)
+	if len(pins) == 0 {
+		return ActionPin{}, false
+	}
+	return pins[0], true
+}
+
+// GetContainerPin returns a pinned container image by its original image reference.
+func GetContainerPin(image string) (ContainerPin, bool) {
+	getActionPins()
+	pin, ok := cachedContainerPins[image]
+	return pin, ok
+}

pkg/actionpins/mappings.go

@@ -0,0 +1,70 @@
+package actionpins
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/github/gh-aw/pkg/console"
+)
+
+var containerDigestPinPattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9/:_.-]*@sha256:[a-f0-9]{64}$`)
+
+// applyActionPinMapping checks ctx.Mappings for a redirect of actionRepo@version and
+// returns the (possibly updated) repo and version. An informational message is printed
+// to stderr the first time each mapping is applied (deduplicated via ctx.Warnings).
+func applyActionPinMapping(actionRepo, version string, ctx *PinContext) (string, string) {
+	if len(ctx.Mappings) == 0 {
+		return actionRepo, version
+	}
+
+	cacheKey := FormatCacheKey(actionRepo, version)
+	mapped, ok := ctx.Mappings[cacheKey]
+	if !ok {
+		return actionRepo, version
+	}
+
+	mappedRepo := ExtractRepo(mapped)
+	mappedVersion := ExtractVersion(mapped)
+	if mappedRepo == "" || mappedVersion == "" {
+		actionPinsLog.Printf("Invalid action_pins mapping value %q for key %q (must be in format owner/repo@ref); skipping", mapped, cacheKey)
+		return actionRepo, version
+	}
+
+	// Emit informational message once per source key.
+	notifyKey := "map:" + cacheKey
+	msg := fmt.Sprintf("Action pin mapping applied: %s → %s", cacheKey, mapped)
+	actionPinsLog.Printf("%s", msg)
+	ctx.emitOnce(notifyKey, msg, console.FormatInfoMessage)
+
+	return mappedRepo, mappedVersion
+}
+
+// ApplyContainerPinMapping checks ctx.ContainerMappings for a redirect of image
+// and returns the (possibly updated) image reference. An informational message is
+// printed to stderr the first time each mapping is applied (deduplicated via
+// ctx.Warnings).
+func ApplyContainerPinMapping(image string, ctx *PinContext) string {
+	if ctx == nil || len(ctx.ContainerMappings) == 0 {
+		return image
+	}
+
+	mapped, ok := ctx.ContainerMappings[image]
+	if !ok {
+		return image
+	}
+
+	if !containerDigestPinPattern.MatchString(mapped) {
+		ctx.emitOnce("container-invalid:"+image,
+			fmt.Sprintf("container_pins: invalid replacement value %q for key %q (must use @sha256:<64 lowercase hex characters>); mapping skipped", mapped, image),
+			console.FormatWarningMessage)
+		return image
+	}
+
+	// Emit informational message once per source key.
+	notifyKey := "container-map:" + image
+	msg := fmt.Sprintf("Container pin mapping applied: %s → %s", image, mapped)
+	actionPinsLog.Printf("%s", msg)
+	ctx.emitOnce(notifyKey, msg, console.FormatInfoMessage)
+
+	return mapped
+}

pkg/actionpins/references.go

@@ -0,0 +1,63 @@
+package actionpins
+
+import (
+	"fmt"
+	"strings"
+)
+
+// getLatestActionPinReference returns the pinned reference for the latest version of the repo.
+// Returns an empty string if no pin is found.
+func getLatestActionPinReference(repo string) string {
+	pins := GetActionPinsByRepo(repo)
+	if len(pins) == 0 {
+		return ""
+	}
+	return FormatPinnedActionReference(repo, pins[0].SHA, pins[0].Version)
+}
+
+// FormatPinnedActionReference formats a pinned action reference with repo, SHA, and version comment.
+// Example: "actions/checkout@abc123 # v4.1.0"
+// Panics if sha is empty, because that would emit invalid workflow YAML and indicates
+// a programming error or corrupted action pin data that should already have been rejected.
+func FormatPinnedActionReference(repo, sha, version string) string {
+	if sha == "" {
+		panic(fmt.Sprintf("FormatPinnedActionReference called with empty SHA for repo=%s version=%s — this would produce invalid workflow YAML", repo, version))
+	}
+	return repo + "@" + sha + " # " + version
+}
+
+func formatPinnedActionWithResolution(repo, sha, sourceVersion, resolvedVersion string) string {
+	if sourceVersion == resolvedVersion || resolvedVersion == "" {
+		return FormatPinnedActionReference(repo, sha, sourceVersion)
+	}
+	if sourceVersion == "" {
+		return FormatPinnedActionReference(repo, sha, resolvedVersion)
+	}
+	return FormatPinnedActionReference(repo, sha, resolvedVersion+" (source "+sourceVersion+")")
+}
+
+// FormatCacheKey generates a cache key for action resolution.
+// Example: "actions/checkout@v4"
+func FormatCacheKey(repo, version string) string {
+	return repo + "@" + version
+}
+
+// ExtractRepo extracts the action repository from a uses string.
+// Examples: "actions/checkout@v5" -> "actions/checkout"
+func ExtractRepo(uses string) string {
+	before, _, ok := strings.Cut(uses, "@")
+	if !ok {
+		return uses
+	}
+	return before
+}
+
+// ExtractVersion extracts the version from a uses string.
+// Examples: "actions/checkout@v5" -> "v5", "actions/checkout" -> ""
+func ExtractVersion(uses string) string {
+	_, after, ok := strings.Cut(uses, "@")
+	if !ok {
+		return ""
+	}
+	return after
+}