Feat: Add sole-org fallback for config resolution

[ModeSevenIndustrialSolutions]

Feat: Add sole-org fallback for config resolution

Ports the shared-resolver fix from harden-runner-block-action#45 (see harden-runner-block-action#44 for the full root-cause analysis) — flagged there as a follow-up for this sibling action.

Problem

Short-form config references (config: '@<sha>') derive both the host org and the org-specific search candidate from the running repository owner. In a fork, the fetched .github tree carries the upstream org's file at the pinned ref, but the candidate path names the fork owner — so resolution can never succeed there.

Fix

When the auto-derived search chain misses, scan the fetched (ref-pinned) tree for <family-dir>/<org>/<filename> entries via git ls-tree:

• Single match → resolve it (matched_candidate: sole-org-fallback) — unambiguous, byte-identical to upstream at the pinned SHA
• Zero or multiple matches → the miss stands, and stays soft (this action proceeds with ignore_vulns alone), consistent with its existing default-path semantics
• Explicit paths never fall back — hard-error semantics preserved
• Same blob-type guard (cat-file -t) and size limit as the candidate loop

Scope

• src/resolve_config_source.py and tests/test_resolve_config_source.py were byte-identical to the sibling repository before the fix and remain byte-identical after it (straight copy of the reviewed, merged versions — including all the hardening from that PR's Copilot cycles: blob guard, generic ambiguity diagnostic, ./.. segment guard)
• README.md search-chain section updated, adapted to this action's soft-miss behaviour
• 59 tests pass (8 new: fork scenario, ambiguity guard, filename/depth filters, non-blob rejection, explicit-path bypass, resolver coordinates)

[Copilot]

Pull request overview

Adds a “sole-org fallback” to config resolution so short-form config references can still resolve correctly when the workflow runs from a fork (where the derived workflow org differs from the upstream org that owns the pinned .github config tree).

Changes:

• Extend resolve() to expose fallback_dir / fallback_filename for auto-derived search modes (but not explicit-path mode).
• Extend fetch_file() to scan the fetched tree via git ls-tree for exactly one <family-dir>/<org>/<filename> match when all candidates miss, and report fallback_used.
• Add tests covering fork scenario, ambiguity, filename/depth filtering, non-blob rejection, and explicit-path bypass; update README search-chain docs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/resolve_config_source.py	Implements the sole-org fallback scan and plumbs fallback coordinates + reporting through the resolver/main flow.
tests/test_resolve_config_source.py	Extends the fake git harness for ls-tree and adds fallback-focused unit tests.
README.md	Documents the new search/fallback step in the config resolution chain.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.