Function resolveLatestRef

pkg/cli/update_workflows.go:257–295

resolveLatestRef resolves the latest ref for a workflow source

(ctx context.Context, repo, currentRef string, allowMajor, verbose bool, coolDown time.Duration)

// resolveLatestRef resolves the latest ref for a workflow source
func resolveLatestRef(ctx context.Context, repo, currentRef string, allowMajor, verbose bool, coolDown time.Duration) (string, error) {
	updateLog.Printf("Resolving latest ref: repo=%s, currentRef=%s, allowMajor=%v", repo, currentRef, allowMajor)

	if verbose {
		fmt.Fprintln(os.Stderr, console.FormatVerboseMessage(fmt.Sprintf("Resolving latest ref for %s (current: %s)", repo, currentRef)))
	}

	// Check if current ref is a tag (looks like a semantic version)
	if isSemanticVersionTag(currentRef) {
		updateLog.Print("Current ref is semantic version tag, resolving latest release")
		return resolveLatestRelease(ctx, repo, currentRef, allowMajor, verbose, coolDown)
	}

	// Check if current ref is a commit SHA (40-character hex string)
	if IsCommitSHA(currentRef) {
		updateLog.Printf("Current ref is a commit SHA: %s, fetching latest from default branch", currentRef)
		// The source field only contains a pinned SHA with no branch information.
		// Fetch the latest commit from the default branch to check for updates.
		return resolveLatestCommitFromDefaultBranch(ctx, repo, currentRef, verbose)
	}

	// Otherwise, treat as branch and get latest commit
	if verbose {
		fmt.Fprintln(os.Stderr, console.FormatVerboseMessage(fmt.Sprintf("Treating %s as branch, getting latest commit", currentRef)))
	}

	// Get the latest commit SHA for the branch
	latestSHA, err := getLatestBranchCommitSHACached(ctx, repo, currentRef)
	if err != nil {
		return "", fmt.Errorf("failed to get latest commit for branch %s: %w", currentRef, err)
	}

	updateLog.Printf("Latest commit for branch %s: %s", currentRef, latestSHA)

	// Return the SHA for comparison so we can detect upstream changes.
	// The caller (updateWorkflow) preserves the branch name in the source
	// field to avoid SHA-pinning — see isBranchRef() usage there.
	return latestSHA, nil
}

// resolveLatestCommitFromDefaultBranch fetches the latest commit SHA from
// the default branch of a repo. This is used when the source field is pinned