actions-warden 0.2.0 → 0.3.0

package/src/commands/pin.js

@@ -1,20 +1,22 @@
 /**
  * Pin command - rewrite tag-based `uses:` refs to immutable commit SHAs.
  *
- * Format: `uses: owner/repo@<sha>  # <original-ref>`
+ * Format: `uses: owner/repo@<sha>  # actions-warden-ref: <original-ref>`
  *
- * The original tag is preserved as an inline comment so upgrades can find
- * the human-readable version later.
+ * The original tag is preserved as explicit metadata so upgrades can find the
+ * human-readable version later.
  */
 
 import { readFile } from 'node:fs/promises';
-import { createHash } from 'node:crypto';
 import { parseWorkflowSource, collectUses } from '../lib/parser.js';
-import { discoverWorkflows, resolveWorkflowArg } from '../lib/paths.js';
-import { resolveRefToSha, resolveToken } from '../lib/resolver.js';
+import { resolveRefToSha, resolveToken, verifyCommitInRepo } from '../lib/resolver.js';
 import { writeFileGuarded } from '../lib/writer.js';
 import { parseIgnoreDirectives, isIgnored } from '../lib/ignore.js';
 import { format } from '../lib/formatter.js';
+import { pinOccurrenceId, canonicalPath } from '../lib/identity.js';
+import { applyPatches, planUsesPatches } from '../lib/patcher.js';
+import { resolveTargets } from '../lib/targets.js';
+import { mapLimit } from '../lib/concurrency.js';
 
 const SHA_RE = /^[0-9a-f]{40}$/i;
 
@@ -39,11 +41,12 @@ const SHA_RE = /^[0-9a-f]{40}$/i;
  * @returns {Promise<{changes: PinChange[], errors: object[], status: 'OK'|'FAIL'}>}
  */
 export async function pin({ cwd = process.cwd(), workflows, dryRun = true, token, fix } = {}) {
-  const files = await resolveTargets(workflows, cwd);
+  const files = await resolveTargets({ workflows, cwd });
   const tok = resolveToken(token);
   /** @type {PinChange[]} */
   const changes = [];
   const errors = [];
+  let matchedFix = false;
 
   for (const file of files) {
     let source;
@@ -62,11 +65,18 @@ export async function pin({ cwd = process.cwd(), workflows, dryRun = true, token
     }
     /** @type {Array<{ref: import('../lib/parser.js').ActionRef, sha: string, type: string}>} */
     const planned = [];
+    const candidates = [];
     const ignore = parseIgnoreDirectives(source);
     for (const { ref } of collectUses(doc)) {
       if (ref.kind !== 'external' && ref.kind !== 'reusable-workflow') continue;
       if (!ref.ref || SHA_RE.test(ref.ref)) continue;
       if (isIgnored(ignore, ref.line, 'unpinned-action')) continue;
+      const id = pinOccurrenceId({ file, cwd, ref });
+      if (fix && fix !== id) continue;
+      if (fix === id) matchedFix = true;
+      candidates.push({ id, ref });
+    }
+    const resolutions = await mapLimit(candidates, 4, async ({ id, ref }) => {
       try {
         const resolved = await resolveRefToSha({
           owner: ref.owner,
@@ -75,17 +85,33 @@ export async function pin({ cwd = process.cwd(), workflows, dryRun = true, token
           token: tok,
           cwd,
         });
-        planned.push({ ref, sha: resolved.sha, type: resolved.type });
+        await verifyCommitInRepo({
+          owner: ref.owner,
+          repo: ref.repo,
+          sha: resolved.sha,
+          token: tok,
+          cwd,
+        });
+        return {
+          planned: { id, ref, sha: resolved.sha, type: resolved.type },
+        };
       } catch (err) {
-        errors.push({ file, action: ref.raw, error: String(err.message ?? err) });
+        return {
+          error: { file, action: ref.raw, error: String(err.message ?? err) },
+        };
       }
+    });
+    for (const result of resolutions) {
+      if (result.planned) planned.push(result.planned);
+      if (result.error) errors.push(result.error);
     }
     if (planned.length === 0) continue;
 
-    let newSource = source;
-    for (const { ref, sha, type } of planned) {
+    const patches = [];
+    const fileChanges = [];
+    for (const { id, ref, sha, type } of planned) {
       const change = {
-        id: changeId(file, ref.raw),
+        id,
         file,
         action: `${ref.owner}/${ref.repo}${ref.subpath ? `/${ref.subpath}` : ''}`,
         fromRef: ref.ref,
@@ -93,14 +119,23 @@ export async function pin({ cwd = process.cwd(), workflows, dryRun = true, token
         line: ref.line,
         refType: type,
       };
-      if (fix && fix !== change.id) continue;
-      newSource = rewriteUses(newSource, ref, sha);
-      changes.push(change);
+      patches.push(...planUsesPatches(source, ref, sha, ref.ref));
+      fileChanges.push(change);
     }
-    if (newSource !== source) {
-      await writeFileGuarded({ path: file, content: newSource, dryRun, cwd });
+    try {
+      const newSource = applyPatches(source, patches);
+      if (newSource !== source) {
+        parseWorkflowSource(newSource, file);
+        await writeFileGuarded({ path: file, content: newSource, dryRun, cwd });
+      }
+      changes.push(...fileChanges);
+    } catch (err) {
+      errors.push({ file, error: String(err.message ?? err) });
     }
   }
+  if (fix && !matchedFix) {
+    errors.push({ error: `fix id not found: ${fix}` });
+  }
   return { changes, errors, status: errors.length === 0 ? 'OK' : 'FAIL' };
 }
 
@@ -115,42 +150,7 @@ export async function pin({ cwd = process.cwd(), workflows, dryRun = true, token
  * @returns {string}
  */
 export function rewriteUses(source, ref, sha) {
-  const left = ref.subpath ? `${ref.owner}/${ref.repo}/${ref.subpath}` : `${ref.owner}/${ref.repo}`;
-  const escLeft = escapeRegExp(left);
-  const escRef = escapeRegExp(ref.ref);
-  // Match: optional quote, owner/repo[/sub]@ref, optional quote, optional comment.
-  const re = new RegExp(
-    `(uses\\s*:\\s*['"]?)${escLeft}@${escRef}(['"]?)([^\\n]*)`,
-    'g',
-  );
-  return source.replace(re, (_, prefix, closingQuote, trailing) => {
-    const tail = stripExistingVersionComment(trailing);
-    return `${prefix}${left}@${sha}${closingQuote}${tail} # ${ref.ref}`;
-  });
-}
-
-function stripExistingVersionComment(trailing) {
-  // Remove any existing inline comment so we don't stack `# v3 # v3`.
-  const idx = trailing.indexOf('#');
-  if (idx === -1) return trailing;
-  return trailing.slice(0, idx).replace(/\s+$/, '');
-}
-
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-function changeId(file, raw) {
-  return createHash('sha1').update(`pin:${file}:${raw}`).digest('hex').slice(0, 10);
-}
-
-async function resolveTargets(workflows, cwd) {
-  if (!workflows || workflows.length === 0) return discoverWorkflows({ cwd });
-  const out = new Set();
-  for (const w of workflows) {
-    for (const f of await resolveWorkflowArg(w, cwd)) out.add(f);
-  }
-  return [...out].sort();
+  return applyPatches(source, planUsesPatches(source, ref, sha, ref.ref));
 }
 
 /**
@@ -163,9 +163,13 @@ export function renderPin(result, opts) {
     return format('json', [], {
       status: result.status,
       json: {
+        schemaVersion: '1.0',
         dryRun: opts.dryRun,
         changes: result.changes.map(c => ({ ...c, file: rel(c.file, cwd) })),
-        errors: result.errors,
+        errors: result.errors.map(error => ({
+          ...error,
+          file: error.file ? rel(error.file, cwd) : undefined,
+        })),
         status: result.status,
       },
     });
@@ -194,6 +198,5 @@ export function renderPin(result, opts) {
 }
 
 function rel(p, cwd) {
-  if (p && p.startsWith(cwd)) return p.slice(cwd.length + 1);
-  return p;
+  return p ? canonicalPath(p, cwd) : p;
 }

package/src/commands/report.js

@@ -7,6 +7,7 @@ import { audit } from './audit.js';
 import { pin } from './pin.js';
 import { upgrade } from './upgrade.js';
 import { format } from '../lib/formatter.js';
+import { canonicalPath } from '../lib/identity.js';
 
 /**
  * @param {object} opts
@@ -14,26 +15,66 @@ import { format } from '../lib/formatter.js';
  * @param {string[]} [opts.workflows]
  * @param {string} [opts.token]
  * @param {'major'|'minor'|'patch'} [opts.mode]
+ * @param {'low'|'medium'|'high'|'critical'} [opts.severity]
+ * @param {boolean} [opts.explain]
  * @param {boolean} [opts.skipResolve]   - when true, skip pin/upgrade (offline mode)
+ * @param {string|false} [opts.configPath]
+ * @param {string} [opts.baseline]
  */
 export async function report({
   cwd = process.cwd(),
   workflows,
   token,
   mode = 'minor',
+  severity,
+  explain = true,
   skipResolve = false,
   minAgeDays = 7,
+  configPath,
+  baseline,
 } = {}) {
-  const auditResult = await audit({ cwd, workflows, explain: true });
+  const auditResult = await audit({
+    cwd,
+    workflows,
+    severity,
+    explain,
+    configPath,
+    baseline,
+  });
   let pinResult = { changes: [], errors: [], status: 'OK' };
   let upgradeResult = { changes: [], errors: [], skipped: [], status: 'OK' };
-  if (!skipResolve) {
-    pinResult = await pin({ cwd, workflows, dryRun: true, token });
-    upgradeResult = await upgrade({ cwd, workflows, dryRun: true, token, mode, minAgeDays });
+  if (!skipResolve && auditResult.files.length > 0) {
+    // Audit owns target discovery and config path filtering. Reuse its exact
+    // file set so every report phase operates on the same scope.
+    const scopedWorkflows = auditResult.files;
+    pinResult = await pin({ cwd, workflows: scopedWorkflows, dryRun: true, token });
+    upgradeResult = await upgrade({
+      cwd,
+      workflows: scopedWorkflows,
+      dryRun: true,
+      token,
+      mode,
+      minAgeDays,
+    });
+    const upgradedOccurrences = new Set(
+      upgradeResult.changes.map(change => `${change.file}:${change.line}`),
+    );
+    pinResult = {
+      ...pinResult,
+      changes: pinResult.changes.filter(
+        change => !upgradedOccurrences.has(`${change.file}:${change.line}`),
+      ),
+    };
   }
   const status = [auditResult.status, pinResult.status, upgradeResult.status].includes('FAIL')
     ? 'FAIL' : 'OK';
-  return { audit: auditResult, pin: pinResult, upgrade: upgradeResult, status };
+  return {
+    audit: auditResult,
+    pin: pinResult,
+    upgrade: upgradeResult,
+    offline: skipResolve,
+    status,
+  };
 }
 
 /**
@@ -46,9 +87,39 @@ export function renderReport(result, opts) {
     return format('json', [], {
       status: result.status,
       json: {
-        audit: { files: result.audit.files.map(f => rel(f, cwd)), findings: result.audit.findings, summary: result.audit.summary },
-        pin: { changes: result.pin.changes.map(c => ({ ...c, file: rel(c.file, cwd) })) },
-        upgrade: { changes: result.upgrade.changes.map(c => ({ ...c, file: rel(c.file, cwd) })), mode: opts.mode },
+        schemaVersion: '1.0',
+        audit: {
+          files: result.audit.files.map(f => rel(f, cwd)),
+          findings: result.audit.findings.map(f => ({ ...f, file: rel(f.file, cwd) })),
+          summary: result.audit.summary,
+          baseline: {
+            ...result.audit.baseline,
+            path: result.audit.baseline.path ? rel(result.audit.baseline.path, cwd) : null,
+          },
+          status: result.audit.status,
+        },
+        pin: {
+          changes: result.pin.changes.map(c => ({ ...c, file: rel(c.file, cwd) })),
+          errors: result.pin.errors.map(error => ({
+            ...error,
+            file: error.file ? rel(error.file, cwd) : undefined,
+          })),
+          status: result.pin.status,
+        },
+        upgrade: {
+          changes: result.upgrade.changes.map(c => ({ ...c, file: rel(c.file, cwd) })),
+          skipped: result.upgrade.skipped.map(skip => ({
+            ...skip,
+            file: skip.file ? rel(skip.file, cwd) : undefined,
+          })),
+          errors: result.upgrade.errors.map(error => ({
+            ...error,
+            file: error.file ? rel(error.file, cwd) : undefined,
+          })),
+          mode: opts.mode,
+          status: result.upgrade.status,
+        },
+        offline: result.offline,
         status: result.status,
       },
     });
@@ -62,6 +133,9 @@ export function renderReport(result, opts) {
         ...finding.fields,
         line: finding.line,
         explain: finding.explain,
+        ...(opts.format === 'sarif' && finding.fingerprint
+          ? { fingerprint: finding.fingerprint }
+          : {}),
       },
     });
   }
@@ -71,6 +145,42 @@ export function renderReport(result, opts) {
   for (const c of result.upgrade.changes) {
     records.push({ label: 'UPGRADE', fields: { id: c.id, file: rel(c.file, cwd), action: c.action, from: c.fromVersion ?? c.fromRef, to: c.toTag, level: c.level } });
   }
+  for (const skipped of result.upgrade.skipped ?? []) {
+    records.push({
+      label: 'SKIP',
+      fields: {
+        stage: 'upgrade',
+        file: rel(skipped.file ?? '', cwd),
+        action: skipped.action,
+        tag: skipped.tag,
+        reason: skipped.reason,
+        age_days: skipped.ageDays,
+        age_source: skipped.ageSource,
+      },
+    });
+  }
+  for (const error of result.pin.errors) {
+    records.push({
+      label: 'ERROR',
+      fields: {
+        stage: 'pin',
+        file: rel(error.file ?? '', cwd),
+        action: error.action,
+        msg: error.error,
+      },
+    });
+  }
+  for (const error of result.upgrade.errors) {
+    records.push({
+      label: 'ERROR',
+      fields: {
+        stage: 'upgrade',
+        file: rel(error.file ?? '', cwd),
+        action: error.action,
+        msg: error.error,
+      },
+    });
+  }
   records.push({
     label: 'SUMMARY',
     fields: {
@@ -82,12 +192,14 @@ export function renderReport(result, opts) {
       low: result.audit.summary.low,
       pins: result.pin.changes.length,
       upgrades: result.upgrade.changes.length,
+      skipped: (result.upgrade.skipped ?? []).length,
+      errors: result.pin.errors.length + result.upgrade.errors.length,
+      offline: result.offline,
     },
   });
   return format(opts.format, records, { status: result.status });
 }
 
 function rel(p, cwd) {
-  if (p && p.startsWith(cwd)) return p.slice(cwd.length + 1);
-  return p;
+  return p ? canonicalPath(p, cwd) : p;
 }

package/src/commands/upgrade.js

@@ -3,23 +3,30 @@
  * permitted by the chosen policy.
  *
  * For SHA-pinned refs, the human-readable version is read from the inline
- * comment (e.g. `# v3.1.0`). If absent, the action is reported as `unknown`
+ * comment (e.g. `# actions-warden-ref: v3.1.0`). Legacy plain semver comments
+ * remain readable. If metadata is absent, the action is reported as `unknown`
  * and skipped.
  */
 
 import { readFile } from 'node:fs/promises';
-import { createHash } from 'node:crypto';
 import semver from 'semver';
 import { parseWorkflowSource, collectUses } from '../lib/parser.js';
-import { discoverWorkflows, resolveWorkflowArg } from '../lib/paths.js';
-import { listTags, pickLatestTag, resolveRefToSha, resolveToken, getCommitDate } from '../lib/resolver.js';
+import {
+  getTagAgeEvidence,
+  listTags,
+  pickLatestTag,
+  resolveRefToSha,
+  resolveToken,
+  verifyCommitInRepo,
+} from '../lib/resolver.js';
 import { writeFileGuarded } from '../lib/writer.js';
 import { parseIgnoreDirectives, isIgnored } from '../lib/ignore.js';
-import { rewriteUses } from './pin.js';
 import { format } from '../lib/formatter.js';
+import { occurrenceId, canonicalPath } from '../lib/identity.js';
+import { applyPatches, planUsesPatches, readVersionComment } from '../lib/patcher.js';
+import { resolveTargets } from '../lib/targets.js';
 
 const SHA_RE = /^[0-9a-f]{40}$/i;
-const INLINE_COMMENT_RE = /uses\s*:[^\n#]*#\s*([^\s]+)/;
 
 /**
  * @typedef {object} UpgradeChange
@@ -54,7 +61,7 @@ export async function upgrade({
   fix,
   minAgeDays = 7,
 } = {}) {
-  const files = await resolveTargets(workflows, cwd);
+  const files = await resolveTargets({ workflows, cwd });
   const tok = resolveToken(token);
   /** @type {UpgradeChange[]} */
   const changes = [];
@@ -62,6 +69,7 @@ export async function upgrade({
   /** @type {object[]} */
   const skipped = [];
   const cooldownMs = Math.max(minAgeDays, 0) * 86_400_000;
+  let matchedFix = false;
 
   for (const file of files) {
     let source;
@@ -71,7 +79,6 @@ export async function upgrade({
       errors.push({ file, error: String(err.message ?? err) });
       continue;
     }
-    const lines = source.split('\n');
     let doc;
     try {
       doc = parseWorkflowSource(source, file);
@@ -85,10 +92,19 @@ export async function upgrade({
     for (const { ref } of collectUses(doc)) {
       if (ref.kind !== 'external' && ref.kind !== 'reusable-workflow') continue;
       if (isIgnored(ignore, ref.line, 'unpinned-action')) continue;
-      const usesLine = lines[ref.line - 1] ?? '';
-      const inlineVersion = readInlineVersion(usesLine);
+      const inlineVersion = readVersionComment(source, ref);
       const currentVersion = ref.ref && SHA_RE.test(ref.ref) ? inlineVersion : ref.ref;
       if (!currentVersion) continue;
+      const id = occurrenceId({
+        kind: 'upgrade',
+        file,
+        cwd,
+        line: ref.line,
+        start: ref.start,
+        subject: ref.raw,
+      });
+      if (fix && fix !== id) continue;
+      if (fix === id) matchedFix = true;
 
       let tags;
       try {
@@ -107,6 +123,7 @@ export async function upgrade({
         token: tok,
         cwd,
         skipped,
+        errors,
         file,
         ref,
       });
@@ -122,17 +139,25 @@ export async function upgrade({
           token: tok,
           cwd,
         });
+        await verifyCommitInRepo({
+          owner: ref.owner,
+          repo: ref.repo,
+          sha: resolved.sha,
+          token: tok,
+          cwd,
+        });
       } catch (err) {
         errors.push({ file, action: ref.raw, error: String(err.message ?? err) });
         continue;
       }
-      planned.push({ ref, latest, sha: resolved.sha, level, currentVersion });
+      planned.push({ id, ref, latest, sha: resolved.sha, level, currentVersion });
     }
 
-    let newSource = source;
-    for (const { ref, latest, sha, level, currentVersion } of planned) {
+    const patches = [];
+    const fileChanges = [];
+    for (const { id, ref, latest, sha, level, currentVersion } of planned) {
       const change = {
-        id: changeId(file, ref.raw, latest.name),
+        id,
         file,
         action: `${ref.owner}/${ref.repo}`,
         fromRef: ref.ref,
@@ -142,15 +167,23 @@ export async function upgrade({
         level,
         line: ref.line,
       };
-      if (fix && fix !== change.id) continue;
-      newSource = rewriteUses(newSource, ref, sha);
-      newSource = fixInlineComment(newSource, ref, latest.name, sha);
-      changes.push(change);
+      patches.push(...planUsesPatches(source, ref, sha, latest.name));
+      fileChanges.push(change);
     }
-    if (newSource !== source) {
-      await writeFileGuarded({ path: file, content: newSource, dryRun, cwd });
+    try {
+      const newSource = applyPatches(source, patches);
+      if (newSource !== source) {
+        parseWorkflowSource(newSource, file);
+        await writeFileGuarded({ path: file, content: newSource, dryRun, cwd });
+      }
+      changes.push(...fileChanges);
+    } catch (err) {
+      errors.push({ file, error: String(err.message ?? err) });
     }
   }
+  if (fix && !matchedFix) {
+    errors.push({ error: `fix id not found: ${fix}` });
+  }
   return { changes, errors, skipped, status: errors.length === 0 ? 'OK' : 'FAIL' };
 }
 
@@ -158,7 +191,20 @@ export async function upgrade({
  * Walk candidate tags newest-first and return the first whose commit is older
  * than the cooldown threshold. Skipped candidates are recorded.
  */
-async function pickAgedTag({ tags, currentRef, mode, cooldownMs, owner, repo, token, cwd, skipped, file, ref }) {
+async function pickAgedTag({
+  tags,
+  currentRef,
+  mode,
+  cooldownMs,
+  owner,
+  repo,
+  token,
+  cwd,
+  skipped,
+  errors,
+  file,
+  ref,
+}) {
   if (cooldownMs <= 0) {
     return pickLatestTag({ tags, currentRef, mode });
   }
@@ -167,12 +213,25 @@ async function pickAgedTag({ tags, currentRef, mode, cooldownMs, owner, repo, to
   for (;;) {
     const candidate = pickLatestTag({ tags: remaining, currentRef, mode });
     if (!candidate) return null;
-    let dateMs;
+    let evidence;
     try {
-      dateMs = await getCommitDate({ owner, repo, sha: candidate.sha, token, cwd });
-    } catch {
-      return candidate;
+      evidence = await getTagAgeEvidence({
+        owner,
+        repo,
+        tag: candidate.name,
+        sha: candidate.sha,
+        token,
+        cwd,
+      });
+    } catch (err) {
+      errors.push({
+        file,
+        action: ref.raw,
+        error: String(err.message ?? err),
+      });
+      return null;
     }
+    const { dateMs, source: ageSource } = evidence;
     if (dateMs <= cutoff) return candidate;
     skipped.push({
       file,
@@ -180,6 +239,7 @@ async function pickAgedTag({ tags, currentRef, mode, cooldownMs, owner, repo, to
       tag: candidate.name,
       reason: 'cooldown',
       ageDays: Math.round((Date.now() - dateMs) / 86_400_000),
+      ageSource,
     });
     const idx = remaining.findIndex(t => t.name === candidate.name);
     if (idx === -1) return null;
@@ -187,11 +247,6 @@ async function pickAgedTag({ tags, currentRef, mode, cooldownMs, owner, repo, to
   }
 }
 
-function readInlineVersion(line) {
-  const m = INLINE_COMMENT_RE.exec(line);
-  return m ? m[1] : null;
-}
-
 function bumpLevel(from, to) {
   const a = semver.coerce(from);
   const b = semver.coerce(to);
@@ -201,34 +256,6 @@ function bumpLevel(from, to) {
   return 'patch';
 }
 
-function fixInlineComment(source, ref, newTag, sha) {
-  const left = ref.subpath ? `${ref.owner}/${ref.repo}/${ref.subpath}` : `${ref.owner}/${ref.repo}`;
-  const escLeft = escRe(left);
-  const escSha = escRe(sha);
-  const re = new RegExp(
-    `(uses\\s*:\\s*['"]?)${escLeft}@${escSha}(['"]?)\\s*#\\s*[^\\n]+`,
-    'g',
-  );
-  return source.replace(re, (_, prefix, closingQuote) => `${prefix}${left}@${sha}${closingQuote} # ${newTag}`);
-}
-
-function escRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-function changeId(file, raw, target) {
-  return createHash('sha1').update(`up:${file}:${raw}->${target}`).digest('hex').slice(0, 10);
-}
-
-async function resolveTargets(workflows, cwd) {
-  if (!workflows || workflows.length === 0) return discoverWorkflows({ cwd });
-  const out = new Set();
-  for (const w of workflows) {
-    for (const f of await resolveWorkflowArg(w, cwd)) out.add(f);
-  }
-  return [...out].sort();
-}
-
 /**
  * @param {Awaited<ReturnType<typeof upgrade>>} result
  * @param {{format: 'toon'|'json'|'text', dryRun: boolean, mode: string, cwd?: string}} opts
@@ -239,11 +266,15 @@ export function renderUpgrade(result, opts) {
     return format('json', [], {
       status: result.status,
       json: {
+        schemaVersion: '1.0',
         dryRun: opts.dryRun,
         mode: opts.mode,
         changes: result.changes.map(c => ({ ...c, file: rel(c.file, cwd) })),
         skipped: (result.skipped ?? []).map(s => ({ ...s, file: rel(s.file ?? '', cwd) })),
-        errors: result.errors,
+        errors: result.errors.map(error => ({
+          ...error,
+          file: error.file ? rel(error.file, cwd) : undefined,
+        })),
         status: result.status,
       },
     });
@@ -266,7 +297,17 @@ export function renderUpgrade(result, opts) {
     });
   }
   for (const s of result.skipped ?? []) {
-    records.push({ label: 'SKIP', fields: { file: rel(s.file ?? '', cwd), action: s.action, tag: s.tag, reason: s.reason, age_days: s.ageDays } });
+    records.push({
+      label: 'SKIP',
+      fields: {
+        file: rel(s.file ?? '', cwd),
+        action: s.action,
+        tag: s.tag,
+        reason: s.reason,
+        age_days: s.ageDays,
+        age_source: s.ageSource,
+      },
+    });
   }
   for (const e of result.errors) {
     records.push({ label: 'ERROR', fields: { file: rel(e.file ?? '', cwd), action: e.action ?? '', msg: e.error } });
@@ -276,6 +317,5 @@ export function renderUpgrade(result, opts) {
 }
 
 function rel(p, cwd) {
-  if (p && p.startsWith(cwd)) return p.slice(cwd.length + 1);
-  return p;
+  return p ? canonicalPath(p, cwd) : p;
 }