lockfile: bump parser to v0.0.2 with simplified pin keys

.github/workflows/test.yml

@@ -19,7 +19,16 @@ jobs:
       - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
-      - run: go test ./...
+      - name: gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "These files are not gofmt-clean:"
+            echo "$unformatted"
+            exit 1
+          fi
+      - run: go vet ./...
+      - run: go test -race -count=1 ./...
 
   integration-stub:
     runs-on: ubuntu-latest

Makefile

@@ -7,13 +7,28 @@ EXT_DIR := $(XDG_DATA_HOME)/gh/extensions/$(EXT_NAME)
 
 RUBY := $(shell command -v /opt/homebrew/opt/ruby/bin/ruby 2>/dev/null || echo ruby)
 
-.PHONY: build test test-integration test-shell test-live test-smoke test-stub test-real install reinstall uninstall
+.PHONY: build test vet fmt fmt-check test-integration test-shell test-live test-smoke test-stub test-real install reinstall uninstall
 
 build:
 	go build -o $(BIN) ./cmd/gh-actions-lock
 
 test:
-	go test ./...
+	go test -race -count=1 ./...
+
+vet:
+	go vet ./...
+
+fmt:
+	gofmt -w .
+
+# Mirrors the CI gofmt gate: fails (non-zero) if anything is unformatted.
+fmt-check:
+	@unformatted="$$(gofmt -l .)"; \
+	if [ -n "$$unformatted" ]; then \
+		echo "These files are not gofmt-clean:"; \
+		echo "$$unformatted"; \
+		exit 1; \
+	fi
 
 test-integration: build
 	$(RUBY) test/integration/run.rb

cmd/gh-actions-lock/check_json_golden_test.go

@@ -1,6 +1,6 @@
 package main
 
-// Golden-file snapshot test for the `gh actions-lock check --json` contract.
+// Golden-file snapshot test for the `gh actions-lock --json` contract.
 //
 // We promised Dependabot the JSON shape is additive-only: no field renames,
 // no removals, no type shifts. New optional fields are allowed. This test
@@ -91,10 +91,10 @@ func TestCheckCommand_JSONGolden(t *testing.T) {
 	copyFixtureTree(t, srcDir, dir)
 	t.Chdir(dir)
 
-	stdout, _, err := runCommandWithHTTPAndReach(t, reg, reachableFunc(),
+	stdout, _, err := runCommandWithHTTP(t, reg,
 		// The fixture's lockfile addresses the workflow as
 		// .github/workflows/ci.yml, so we run check on that exact path.
-		"check", "--rescan", "--no-fix", "--json=valid,findings,workflows,dependencies",
+		"--rescan", "--no-fix", "--json=valid,findings,workflows,dependencies",
 		".github/workflows/ci.yml",
 	)
 	// We expect findings (ref-changed + stale), so the command exits