[duplicate-code] Duplicate Code: Commit SHA resolution duplicated in action_resolver

[github-actions]

Overview

The latest commit introduced a second implementation of GitHub commit-ref-to-SHA resolution inside pkg/workflow/action_resolver.go. The new helper and an existing resolver perform the same network call, timeout setup, output normalization, and SHA validation with only minor differences in path construction and error wording.

Key metrics/issues

• Severity: Medium
• Occurrences: 2
• Analyzed files: 4 changed non-test Go files
• Commit: ba0a9f958976c1d8d1baf3d2fc5a6aade16d01f2

Duplication details

Pattern: resolve a branch/tag/SHA ref to a full commit SHA via gh api /repos/.../commits/{ref} --jq .sha

Locations:

• pkg/workflow/action_resolver.go:261
• pkg/workflow/action_resolver.go:308

Code sample:

callCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
defer cancel()
cmd := ExecGHContext(callCtx, "api", apiPath, "--jq", ".sha")
output, err := cmd.Output()
sha := strings.TrimSpace(string(output))
if !gitutil.IsValidFullSHA(sha) {
    return "", fmt.Errorf("unexpected response ...")
}

Impact analysis

• Maintainability: Ref-resolution behavior now needs to be updated in two places when auth handling, timeout policy, logging, or response validation changes.
• Bug risk: Error handling already diverges (Output vs CombinedOutput, host forcing in one path only, slightly different diagnostics), which makes future fixes easy to apply inconsistently.
• Code bloat: The commit added a new helper instead of reusing the existing commit-resolution path.

Refactoring recommendations

1. Extract a shared helper for commit endpoint resolution.
   Extract common functionality to: pkg/workflow/action_resolver.go
   Estimated effort: 1-2 hours
   Benefits: one place for timeout, gh api invocation, host setup, output parsing, and SHA validation.

2. Parameterize only the repo/ref-specific pieces.
   Estimated effort: low
   Benefits: keeps ResolveGhAwRef and resolveRefViaCommitsEndpoint as thin wrappers with context-specific logging.

Implementation checklist

• Review duplication findings
• Extract shared commit-ref resolution helper
• Update both callers to use the helper
• Preserve existing diagnostics where needed
• Update tests
• Verify no behavior regression

Analysis metadata

• Detection method: Serena semantic code analysis
• Analysis date: 2026-08-08T21:59:53Z
• Commit: ba0a9f958976c1d8d1baf3d2fc5a6aade16d01f2

Assignee: @copilot

Generated by 🔍 Duplicate Code Detector · gpt54 · 63.5 AIC · ⊞ 12.9K · ◷

• expires on Aug 10, 2026, 2:02 PM UTC-08:00