[dead-code] chore: remove dead functions — 4 functions removed

[github-actions]

Dead Code Removal

This PR removes unreachable Go functions identified by the deadcode static analyzer.

Functions Removed

Function	File
GetActionPins	pkg/actionpins/actionpins.go
FetchWorkflowFromSource	pkg/cli/fetch.go
getActionPins	pkg/workflow/action_pins.go
Compiler.buildConsolidatedSafeOutputStep	pkg/workflow/compiler_safe_outputs_steps.go

Tests Removed

Test	File	Reason
TestSpec_PublicAPI_GetActionPins	pkg/actionpins/spec_test.go	Exclusively tested deleted GetActionPins
TestFetchWorkflowFromSource_LocalRouting	pkg/cli/remote_workflow_test.go	Exclusively tested deleted FetchWorkflowFromSource
TestFetchWorkflowFromSource_RemoteRoutingWithInvalidSlug	pkg/cli/remote_workflow_test.go	Exclusively tested deleted FetchWorkflowFromSource
TestActionPinsExist	pkg/workflow/action_pins_test.go	Exclusively tested deleted getActionPins
TestGetActionPinsSorting	pkg/workflow/action_pins_test.go	Exclusively tested deleted getActionPins
TestActionPinsCaching	pkg/workflow/action_pins_test.go	Exclusively tested deleted getActionPins
TestBuildConsolidatedSafeOutputStep	pkg/workflow/compiler_safe_outputs_steps_test.go	Exclusively tested deleted buildConsolidatedSafeOutputStep
TestStepWithoutCondition	pkg/workflow/compiler_safe_outputs_steps_test.go	Exclusively tested deleted buildConsolidatedSafeOutputStep
TestGitHubTokenPrecedence	pkg/workflow/compiler_safe_outputs_steps_test.go	Exclusively tested deleted buildConsolidatedSafeOutputStep
TestScriptNameVsInlineScript	pkg/workflow/compiler_safe_outputs_steps_test.go	Exclusively tested deleted buildConsolidatedSafeOutputStep

Non-exclusive tests in spec_test.go that used GetActionPins() as a helper to discover a known repo were updated to use the hardcoded "actions/checkout" instead.

Verification

• ✅ go build ./... — passes
• ✅ go vet ./... — passes
• ✅ go vet -tags=integration ./... — passes
• ✅ make fmt — no changes needed
• ✅ go test ./pkg/actionpins/... ./pkg/cli/... ./pkg/workflow/... — all pass

Dead Function Count

• Before this batch: 10 functions
• Removed in this PR: 4 functions (skipped CompileToYAML, ParseWorkflowString — WASM live; skipped WithNoEmit, WithSkipValidation, WithWorkflowIdentifier — WASM live; skipped WithVersion — used in 50+ tests)
• Remaining: ~6 functions

---

Automated by Dead Code Removal workflow — https://github.com/github/gh-aw/actions/runs/24721363769

Generated by Dead Code Removal Agent · ● 5M · ◷

• expires on Apr 24, 2026, 12:22 PM UTC

[github-actions]

Great work from the Dead Code Removal Agent! 🤖 This PR cleanly removes 4 unreachable functions (GetActionPins, FetchWorkflowFromSource, getActionPins, Compiler.buildConsolidatedSafeOutputStep) and thoughtfully prunes all tests that exclusively covered them — while preserving non-exclusive tests by updating them to use hardcoded values. The verification block and dead-function accounting table make the scope crystal clear.

This looks ready for maintainer review. ✅

Generated by Contribution Check · ● 1.4M · ◷

[pelikhan]

@copilot recompile

[Copilot]

Pull request overview

Removes functions flagged as unreachable by the deadcode analyzer, along with tests that exclusively covered those functions, and updates remaining tests accordingly.

Changes:

• Removed dead/unused functions in pkg/actionpins, pkg/cli, and pkg/workflow.
• Deleted tests that only validated the removed functions.
• Updated pkg/actionpins/spec_test.go to use a stable known repo (actions/checkout) instead of calling the deleted API.

Show a summary per file

File	Description
pkg/workflow/compiler_safe_outputs_steps.go	Removes Compiler.buildConsolidatedSafeOutputStep implementation.
pkg/workflow/compiler_safe_outputs_steps_test.go	Removes tests that only exercised buildConsolidatedSafeOutputStep.
pkg/workflow/action_pins.go	Removes package-private getActionPins test wrapper.
pkg/workflow/action_pins_test.go	Removes tests that only exercised the deleted getActionPins wrapper.
pkg/cli/fetch.go	Removes exported FetchWorkflowFromSource wrapper.
pkg/cli/remote_workflow_test.go	Removes tests that only exercised FetchWorkflowFromSource.
pkg/actionpins/actionpins.go	Removes exported GetActionPins function.
pkg/actionpins/spec_test.go	Removes GetActionPins spec test and updates remaining tests to use actions/checkout.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

pkg/cli/fetch.go:51

• Removing the exported FetchWorkflowFromSource wrapper is a breaking change for any external consumers of pkg/cli, and the pkg/cli public API documentation currently lists this function. If the intent is purely internal dead-code cleanup, consider restoring it as a backward-compatible wrapper around FetchWorkflowFromSourceWithContext(context.Background(), ...) (or update the documented public API and versioning accordingly).

// FetchWorkflowFromSourceWithContext fetches a workflow file from local disk or GitHub.
// The context is used to cancel remote ref resolution retries (for example, on Ctrl-C).
func FetchWorkflowFromSourceWithContext(ctx context.Context, spec *WorkflowSpec, verbose bool) (*FetchedWorkflow, error) {
	remoteWorkflowLog.Printf("Fetching workflow from source: spec=%s", spec.String())

	// Handle local workflows
	if isLocalWorkflowPath(spec.WorkflowPath) {
		return fetchLocalWorkflow(spec, verbose)
	}

	// Handle remote workflows from GitHub
	return fetchRemoteWorkflow(ctx, spec, verbose)
}

• Files reviewed: 8/8 changed files
• Comments generated: 1

[Copilot]

Removing the exported GetActionPins function is a breaking change for any external consumers of pkg/actionpins, and the package docs/spec currently list GetActionPins as part of the public API. Consider keeping GetActionPins as a thin wrapper around getActionPins() (or deprecating it first) and updating the public API documentation/spec accordingly if you intend to remove it.

Suggested change

	// GetActionPins returns the cached set of action pins loaded from the embedded JSON.
	// It is kept as part of the package's public API for external consumers.
	func GetActionPins() []ActionPin {
	return getActionPins()
	}

[github-actions]

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

✅ Excellent — dead-code cleanup with targeted test improvements

Metric	Value
New/modified tests analyzed	3
✅ Design tests (behavioral contracts)	3 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	3 (100%)
Duplicate test clusters	0
Test inflation detected	No (net −472 test lines)
🚨 Coding-guideline violations	None

---

Context

This PR removes 4 dead production functions and cleans up their associated tests (~472 test lines deleted). The only additions are 3 line-level modifications to existing test sub-functions that replace a dependency on the now-deleted GetActionPins() with a hardcoded "actions/checkout" constant. These modifications are strictly improvements:

• Tests become deterministic (no longer skip when GetActionPins() returns empty)
• The t.Skip("no embedded pin data available") escape hatch is removed — tests now always run
• No behavioral contract is weakened

Test Classification Details

View Modified Test Details (3 sub-tests in pkg/actionpins/spec_test.go)

Test	File	Classification	Notes
TestSpec_PublicAPI_GetActionPinsByRepo — "returns pins for a known repository" sub-test	pkg/actionpins/spec_test.go	✅ Design	Asserts non-empty result for hardcoded known repo; parent function also has unknown-repo error case
TestSpec_PublicAPI_GetActionPinByRepo — "returns a pin for a known repository" sub-test	pkg/actionpins/spec_test.go	✅ Design	Asserts ok == true and correct .Repo field; parent also covers not-found path
TestSpec_PublicAPI_ResolveLatestActionPin — "returns latest pinned reference" sub-test	pkg/actionpins/spec_test.go	✅ Design	Uses require.True to gate on lookup success, then asserts version fields

---

Language Support

Tests analyzed:

• 🐹 Go (*_test.go): 3 modified sub-tests — all unit (//go:build !integration)
• 🟨 JavaScript (*.test.cjs, *.test.js): 0 changes

---

Verdict

✅ Check passed. 0% of changed tests are implementation tests (threshold: 30%). The test deletions are appropriate cleanup for removed dead code, and the three modified sub-tests are improved by using explicit, deterministic inputs.

---

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

• Assert on observable outputs, return values, or state changes
• Cover error paths and boundary conditions
• Would catch a behavioral regression if deleted
• Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

• Assert on internal function calls (mocking internals)
• Only test the happy path with typical inputs
• Break during legitimate refactoring even when behavior is correct
• Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

References: §24725278020

🧪 Test quality analysis by Test Quality Sentinel · ● 551K · ◷

[github-actions]

✅ Test Quality Sentinel: 100/100. Test quality is excellent — 0% of changed tests are implementation tests (threshold: 30%). Dead-code cleanup with 3 test sub-functions improved to use deterministic inputs.

[Copilot]

@copilot recompile

Done in 28f8050 — I ran make recompile and committed the regenerated docs outputs.