copy: explain how to replace orphaned SHA refs

Author: nodeselector

internal/resolve/discover_test.go

@@ -389,6 +389,10 @@ func TestReverseLookup_FailsClosedOnImpostor(t *testing.T) {
 	if issues[0].NWO != "actions/checkout" {
 		t.Errorf("expected NWO=actions/checkout, got %q", issues[0].NWO)
 	}
+	want := "this commit has no exact tag and is not on any branch — update the workflow to use a current upstream tag or branch, then rerun"
+	if issues[0].Message != want {
+		t.Errorf("message = %q, want %q", issues[0].Message, want)
+	}
 }
 
 type roundTripFunc func(*http.Request) (*http.Response, error)

internal/resolve/reverse_lookup.go

@@ -279,7 +279,7 @@ func (r *Resolver) ReverseLookup(ctx context.Context, deps []dep.Dependency) (ma
 		if tag == "" && branch == "" {
 			var msg string
 			if LooksLikeSHA(d.Ref) {
-				msg = fmt.Sprintf("no tag or branch contains this commit — a symbolic ref is required for the lockfile")
+				msg = "this commit has no exact tag and is not on any branch — update the workflow to use a current upstream tag or branch, then rerun"
 			} else {
 				msg = fmt.Sprintf("commit %s is not reachable from any ref (tag or branch) — orphaned commit",
 					parserlock.ShortSHA(d.SHA))