feat: trace transitive GitHub Actions dependencies with bounded read-only audits

[narenaryan]

Capability

Implements the read-only first increment of #56: scharf audit <repo> --dependencies --out human|json|sarif follows composite actions and reusable workflows at resolved commits, exposing mutable children hidden behind pinned wrappers. Reports retain each caller chain and immutable metadata locations. Existing direct audit/autofix defaults stay unchanged.

Safety and limits

• Resolves remote refs once per invocation and caches metadata by repository/commit/path; no third-party action or fixture workflow is executed.
• Supports action subpaths, action.yml/action.yaml, nested/local reusable workflows, defining-repository $/, and aliases with caller locations. Ambiguous ./ in remote composites is unresolved.
• Depth, structural-visit, aggregate byte, per-response byte, request-count and HTTP timeout budgets. Missing/inaccessible metadata, cycles, unsupported YAML structures and exhausted budgets are explicitly incomplete and return an error.
• Rooted filesystem reads and Unix nonblocking opens guard path escapes/FIFOs; HTTP redirects refused. Untrusted human-report text escapes control characters.
• --raise-error rejects mutable edges; JSON/SARIF preserve provenance and incomplete status. Policy exceptions/baselines, transitive autofix and combined graph/provenance mode are deliberately unsupported rather than silently weakened.
• Graph scope excludes Docker-image reference auditing, shell/JS downloads, package dependencies and container contents. Pinning is not trust or upstream-history verification; feat(resolver): verify upstream SHA provenance and expose moved-reference evidence #58 is separate. Local files are working-tree snapshots. $/ needs runner 2.336.0+.

Validation

Approved workspace-only Go 1.26.9, archive SHA256 checked against official go.dev metadata. Passed against final code:

• gofmt on changed/new Go files
• go test ./... (all six packages; 32 new test functions)
• go vet ./...
• go test -race ./...
• go mod verify
• Linux build; Windows amd64 and macOS arm64 cross-builds (cross-built binaries not run)
• Isolated real CLI smoke scan of local parse-only fixtures
• git diff --check

Independent source review found and fixed alias false-clean paths, caller-location loss, unsupported mapping keys, filesystem races/FIFO blocking, diagnostic loss and terminal/log-command injection. Tests use HTTP fakes, not live action execution.

Unavailable and NOT claimed passed: goimports, golangci-lint, govulncheck. No additional tool installation was authorized; exact-head CI results are recorded below. No agentskb MCP operations were available to consult.

Sources/design

• GitHub metadata syntax
• GitHub repository contents API
• Self-repository action syntax
• ADR 004 documents decisions, alternatives and boundaries.

Related to #56. Kept draft for human review; no automatic issue closure or merge.

AI bug-pattern reassessment (October 8, 2026)

Used ai-bug-patterns to review omitted validation, bounded work, cached state and error paths. Reproduced and fixed three boundary failures: run-only/malformed YAML aliases bypassed edge-only accounting; depth-limited traversal contacted children beyond the boundary; byte exhaustion continued reading sibling roots. Structural work now consumes a 5,000-visit budget and global node/byte exhaustion stops traversal; depth is checked before network activity.

Seven new tests cover these regressions plus empty documents, defining-repository cache isolation and per-invocation cache lifetime. Full unit tests, race tests, vet, build, module verification, formatting and whitespace checks passed on the revised tree 7c31b9d3b195fe28d0a3b039ea2a41e3e6fd8e24. Local HTTP fixtures only; no live action execution. CI for revised head 786be022bc07bc1b1103dec071e3254b80d607c2 is successful: GitHub unit tests, Semgrep, binary-size comparison and Semaphore. No additional tools installed.

The revised #61/#62 heads also form conflict-free local merge-tree 7d43701bcf888efe312e26ac33c98f436c2cef29, which passed unit tests, race tests and vet, plus an archive build with -buildvcs=false. This is integration evidence only; no PR was merged.