[jay23606]

Summary

A lockfile whose owner_id changes while owner/repo remains unchanged now produces a blocking owner-id-changed finding. The CLI reports it and prevents pinning/remediation from treating the action as verified. Repository transfers that change the canonical name continue to use the existing repo-renamed warning.

Design choice: Treating a same-name owner identity mismatch as blocking follows the issue's expectation that the lockfile is invalid and the maintainer's note that stricter validation is appropriate. The alternative is to keep accepting the mismatch; this change instead preserves the transfer case when the repository name also changes.

Fixes #211

Validation

• Regression test on clean base 4f01e43: failed because the mismatch produced no finding.
• Same regression test on this branch: passed.
• go test ./internal/pipeline/... ./cmd/gh-actions-lock/format: passed.
• go vet ./..., gofmt -l, and git diff --check: passed.
• go test ./... fails on both base and this branch in symlink tests because Windows reports A required privilege is not held by the client; no other packages failed.
• go test -race was not verified: this Windows Go environment has CGO disabled, and Go is unavailable in WSL.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.