[code-simplifier] refactor: extract lookupContainerPin helper to eliminate duplication (#27762 follow-up)

[github-actions]

Overview

Follow-up simplification to #27762 ("Pin builtin container images by digest"). The cache-first, embedded-fallback pattern for container pin resolution was introduced in two places with identical structure but different return fields used by each caller.

Files Simplified

• pkg/workflow/action_pins.go — added lookupContainerPin helper
• pkg/workflow/docker.go — applyContainerPins uses lookupContainerPin
• pkg/workflow/awf_helpers.go — resolveContainerDigest uses lookupContainerPin

Improvement Made

Reduced Duplication — Extracted lookupContainerPin helper

Both applyContainerPins (docker.go) and resolveContainerDigest (awf_helpers.go) implemented the same cache-first, embedded-fallback logic:

// Before — repeated in two places:
if cache != nil {
    if pin, ok := cache.GetContainerPin(img); ok && pin.X != "" {
        // use pin
        continue
    }
}
if embeddedPin, ok := getEmbeddedContainerPin(img); ok && embeddedPin.X != "" {
    // use embeddedPin
    continue
}

// After — single shared lookup:
if pin, ok := lookupContainerPin(img, cache); ok && pin.X != "" {
    // use pin
}

The new helper in action_pins.go:

func lookupContainerPin(image string, cache *ActionCache) (ContainerPin, bool) {
    if cache != nil {
        if pin, ok := cache.GetContainerPin(image); ok {
            return pin, true
        }
    }
    if pin, ok := getEmbeddedContainerPin(image); ok {
        return ContainerPin(pin), true
    }
    return ContainerPin{}, false
}

Changes Based On

Recent changes from:

• Pin builtin container images by digest in compiled lock files and AWF hash-spec configuration #27762 — Pin builtin container images by digest in compiled lock files and AWF hash-spec configuration

Testing

• ✅ All related tests pass (TestApplyContainerPins, TestBuildAWFImageTagWithDigests, TestBuildAWFArgs_ImageTagIncludesDigests, TestGetContainerPin_ReturnsPinnedImage)
• ✅ go vet clean
• ✅ Build succeeds (make build)
• ✅ No functional changes — behavior is identical

Review Focus

Please verify:

• Functionality is preserved (same cache-first, embedded-fallback semantics)
• lookupContainerPin correctly unifies both lookup patterns

---

Automated by Code Simplifier Agent — analyzing code from the last 24 hours

Generated by Code Simplifier · ● 2.6M · ◷

• expires on Apr 23, 2026, 6:24 AM UTC

[github-actions]

Hey @github-actions[bot] 👋 — great clean-up on the lookupContainerPin extraction! The before/after breakdown in the description makes the intent crystal clear, and the reduction from ~18 lines of duplicated cache-first/embedded-fallback logic down to a single shared call is a solid simplification of the #27762 follow-up.

One thing that would make this even more solid:

• Add a unit test for lookupContainerPin — the helper itself isn't directly exercised by the existing tests (which go through applyContainerPins and resolveContainerDigest). A small table-driven test covering the three cases — cache hit, embedded fallback, and not-found — would give the helper its own coverage and guard against future regressions independently of its callers.

If you'd like a hand, you can assign this prompt to your coding agent:

Add a unit test for the lookupContainerPin helper in pkg/workflow/action_pins.go (or the corresponding _test.go file).

Cover these three scenarios using a table-driven test:
1. Cache hit — cache contains the image pin → should return the cached ContainerPin and true.
2. Embedded fallback — cache is nil (or doesn't contain the image) but embedded pins has it → should return the embedded ContainerPin and true.
3. Not found — neither cache nor embedded pins has the image → should return an empty ContainerPin and false.

Follow the existing table-driven test patterns in pkg/workflow/ and run `make test-unit` to confirm all tests pass.

Generated by Contribution Check · ● 1.4M · ◷

[Copilot]

Pull request overview

Refactors container pin resolution by extracting a shared lookupContainerPin helper to remove duplicated “cache-first, embedded-fallback” logic introduced in #27762.

Changes:

• Added lookupContainerPin(image, cache) helper in pkg/workflow/action_pins.go.
• Updated applyContainerPins to use the helper for pinned image resolution.
• Updated resolveContainerDigest to use the helper for digest resolution.

Show a summary per file

File	Description
pkg/workflow/action_pins.go	Introduces shared helper for container pin lookup (cache then embedded).
pkg/workflow/docker.go	Uses helper inside applyContainerPins to resolve pinned image refs and manifest entries.
pkg/workflow/awf_helpers.go	Uses helper inside resolveContainerDigest for AWF image-tag digest metadata.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 2