Summary

Closes the deferred follow-up from #47 (actions audit).

sakimori actions audit was offline-only: it flagged foo/bar@v1
as a mutable ref but left the user to manually look up what to pin
to. New --resolve flag (off by default) hits the GitHub REST API
and surfaces the resolved SHA on each finding so the user can
copy-paste the fix straight from the report.

sakimori actions audit --resolve .github/workflows/*.yml

.github/workflows/ci.yml  (0 ok, 7 warn, 4 error)
  ERROR  build/checkout: mutable tag `v4` on third-party action `foo/bar` …
         → resolved: b4ffde65f46336ab88eb53be808477a3936bae11

Architecture

• actions::Resolver trait keeps the offline path the default and
  lets tests substitute a deterministic fake.
• actions::GithubResolver is the concrete impl: GET /repos/{o}/{r}/commits/{ref}
  via ureq, reads GITHUB_TOKEN to raise the rate limit to
  5000/hour.
• actions::resolve_all(&mut findings, &dyn Resolver) walks
  findings, caches per (owner, repo, ref) so a workflow that uses
  actions/checkout@v4 ten times only hits the API once, and
  populates Finding::resolved_sha (or Finding::resolve_error
  when the lookup fails — one rate-limited action shouldn't kill
  the whole audit).

Schema additions

Finding gains two Option<String> fields, both
skip_serializing_if = "Option::is_none" so off-by-default
consumers (no --resolve) see no JSON-shape change:

• resolved_sha: 40-char hex when the lookup succeeded.
• resolve_error: human-readable reason when it failed
  (HTTP 403, HTTP 404, network timeout, …).

Test plan

• cargo fmt --all -- --check

• cargo clippy --workspace --all-targets -- -D warnings

• cargo test --workspace — 5 new unit tests in actions::tests:

  • resolve_all_fills_sha_for_mutable_refs_and_skips_pinned_ones
  • resolve_all_caches_repeated_lookups
  • resolve_all_records_error_per_finding_without_aborting
  • finding_owner_repo_extraction_handles_subpath_and_local
  • url_encode_ref_handles_slashes_and_pluses

  142 total in sakimori-core, all green.

• sakimori actions audit --help shows the new flag

• Build succeeds on the (no-network) macOS dev box —
  GithubResolver::new doesn't make any calls until
  resolve_all is invoked, so it's safe to construct.

🤖 Generated with Claude Code