Should --fix for unpinned-uses pin to the full version, when given the major version?

[inahga]

Consider

- uses: actions/checkout@v6

This is appropriately flagged, and --fix=all will expand it to:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

However, leaving the tag at v6 is not very useful. When actions/checkout updates, and moves its v6 tag forward, this workflow will start to fail lints with ref-version-mismatch.

It would be better if zizmor resolved v6 to the latest available full version tag, and used that.

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Note that ref-version-mismatch has an effective autofix which will expand the version tag, but that only applies once the action is updated and we have failing CI. It would be better if the autofix just fixed it right in the first place.

(This is also particularly annoying because I have 20 or so repos to blast zizmor across 😭)

Happy to contribute a changeset, just checking if the maintainers are OK with this first.

[woodruffw]

Hi @inahga, thanks for opening this!

Yeah, this is unfortunate at the moment -- I agree that we should probably find do one additional hop (go ref-to-commit, then map the commit back to its longest ref) for the autofix. IIRC the reason I didn't consider this originally is because ref-version-mismatch didn't exist at the time 🙂

A patch would be greatly appreciated -- there's a longest_tag_for_commit API that exists for these kinds of cases and should be pretty easy to slot in.

(I'm going to convert this to a feature request issue.)

[woodruffw]

#2093