refactor(doctor): extract session state, comparison, and picker helpers

- Extract sessionState type from Remediator into session.go
  (choices, internalRefChoices, approvedRefs maps + their methods)
- Extract compareSnapshots() from diagnoseOneWorkflow into compare.go
  with matchLiveDep() and unmatchedFindings() helpers
- Extract tag picker rendering (tagLabel, defaultBranchOption) and
  selection handling (runPicker) into picker.go
- Both handleSHAWithSuggestions and handleSHATagPicker now use shared
  picker infrastructure while keeping their distinct control flow

Net reduction of ~210 lines from existing files. No behavior change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: nodeselector

internal/doctor/apply.go

@@ -7,47 +7,6 @@ import (
 	"github.com/github/gh-actions-pin/internal/lockfile"
 )
 
-// choiceKey returns a stable key for session memory: "owner/repo@SHA".
-func (rem *Remediator) choiceKey(dep *lockfile.Dependency) string {
-	return dep.NWO + "@" + dep.SHA
-}
-
-// recordChoice saves a tag choice for a dep so it can be auto-applied later.
-func (rem *Remediator) recordChoice(dep *lockfile.Dependency, tag string) {
-	rem.choices[rem.choiceKey(dep)] = tag
-}
-
-// recallChoice returns (tag, true) if we already made a choice for this dep.
-func (rem *Remediator) recallChoice(dep *lockfile.Dependency) (string, bool) {
-	tag, ok := rem.choices[rem.choiceKey(dep)]
-	return tag, ok
-}
-
-// refKey returns a session memory key for an unpinned action ref: "owner/repo@ref".
-func refKey(ref lockfile.ActionRef) string {
-	return ref.FullName() + "@" + ref.Ref
-}
-
-// markRefsApproved records all action refs as approved for auto-pinning.
-func (rem *Remediator) markRefsApproved(refs []lockfile.ActionRef) {
-	for _, ref := range refs {
-		rem.approvedRefs[refKey(ref)] = true
-	}
-}
-
-// allRefsApproved returns true if every ref was already approved in a prior workflow.
-func (rem *Remediator) allRefsApproved(refs []lockfile.ActionRef) bool {
-	if len(refs) == 0 {
-		return false
-	}
-	for _, ref := range refs {
-		if !rem.approvedRefs[refKey(ref)] {
-			return false
-		}
-	}
-	return true
-}
-
 // isSHARef returns true if ref looks like a full commit SHA (40 or 64 hex chars).
 func isSHARef(ref string) bool {
 	return lockfile.IsFullSHA(ref)

internal/doctor/compare.go

@@ -0,0 +1,104 @@
+package doctor
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/github/gh-actions-pin/internal/lockfile"
+)
+
+// compareSnapshots compares pinned dependencies against a live resolution and
+// returns findings for any discrepancies: ref moves, ref changes, and stale deps.
+func compareSnapshots(path string, existing, live []lockfile.Dependency, directNWOs map[string]bool) []Finding {
+	liveByKey := make(map[string]lockfile.Dependency, len(live))
+	liveByNWO := make(map[string][]lockfile.Dependency, len(live))
+	for _, dep := range live {
+		liveByKey[dep.Key()] = dep
+		liveByNWO[dep.NWO] = append(liveByNWO[dep.NWO], dep)
+	}
+
+	var findings []Finding
+	for _, pinned := range existing {
+		if lockfile.IsFullSHA(pinned.Ref) {
+			continue
+		}
+
+		resolved, ok := matchLiveDep(pinned, liveByKey, liveByNWO)
+		if !ok {
+			findings = append(findings, unmatchedFindings(path, pinned, liveByNWO, directNWOs)...)
+			continue
+		}
+		if !strings.EqualFold(pinned.SHA, resolved.SHA) {
+			resolvedCopy := resolved
+			findings = append(findings, Finding{
+				WorkflowPath: path,
+				Category:     CategoryRefMoved,
+				Severity:     SeverityError,
+				Dependency:   &pinned,
+				Detail:       fmt.Sprintf("pinned %s but ref now resolves to %s", pinned.SHA[:12], resolvedCopy.SHA[:12]),
+				Remediation:  fmt.Sprintf("update to %s with `gh actions-pin upgrade`", resolvedCopy.SHA[:12]),
+			})
+		}
+	}
+	return findings
+}
+
+// matchLiveDep tries to find a live dependency matching the pinned one.
+// First by exact key, then fuzzy by NWO (same SHA or narrowed version).
+func matchLiveDep(pinned lockfile.Dependency, byKey map[string]lockfile.Dependency, byNWO map[string][]lockfile.Dependency) (lockfile.Dependency, bool) {
+	if dep, ok := byKey[pinned.Key()]; ok {
+		return dep, true
+	}
+	if candidates, has := byNWO[pinned.NWO]; has {
+		for _, cand := range candidates {
+			if strings.EqualFold(cand.SHA, pinned.SHA) {
+				return cand, true
+			}
+			if IsNarrowedVersion(cand.Ref, pinned.Ref) {
+				return cand, true
+			}
+		}
+	}
+	return lockfile.Dependency{}, false
+}
+
+// unmatchedFindings produces findings for a pinned dep that has no live match:
+// either a ref change (direct dep with different ref) or stale (orphaned).
+func unmatchedFindings(path string, pinned lockfile.Dependency, liveByNWO map[string][]lockfile.Dependency, directNWOs map[string]bool) []Finding {
+	if directNWOs[pinned.NWO] {
+		if candidates, has := liveByNWO[pinned.NWO]; has && len(candidates) > 0 {
+			newDep := candidates[0]
+			if newDep.Ref != pinned.Ref {
+				refOwner, refRepo := pinned.OwnerRepo()
+				return []Finding{{
+					WorkflowPath: path,
+					Category:     CategoryRefChanged,
+					Severity:     SeverityWarning,
+					Dependency:   &pinned,
+					ActionRef: &lockfile.ActionRef{
+						Owner: refOwner,
+						Repo:  refRepo,
+						Ref:   newDep.Ref,
+					},
+					Detail:      fmt.Sprintf("ref changed from %s to %s in workflow — re-pin to update", pinned.Ref, newDep.Ref),
+					Remediation: "re-pin to match the new ref",
+				}}
+			}
+		}
+	}
+
+	detail := "no longer in workflow — will be cleaned up"
+	remediation := "re-resolve to remove orphaned dependency"
+	if !directNWOs[pinned.NWO] {
+		detail = "transitive dependency no longer discovered from upstream composite action"
+		remediation = "re-resolve to clean up"
+	}
+	return []Finding{{
+		WorkflowPath: path,
+		Category:     CategoryStale,
+		Severity:     SeverityInfo,
+		Dependency:   &pinned,
+		Detail:       detail,
+		Remediation:  remediation,
+	}}
+}

internal/doctor/diagnose.go

@@ -2,7 +2,6 @@ package doctor
 
 import (
 	"fmt"
-	"strings"
 
 	"github.com/github/gh-actions-pin/internal/lockfile"
 	"github.com/github/gh-actions-pin/internal/resolver"
@@ -166,100 +165,8 @@ func diagnoseOneWorkflow(path string, r *resolver.Resolver) WorkflowReport {
 		})
 	}
 
-	depsByKey := make(map[string]lockfile.Dependency)
-	for _, dep := range existingDeps {
-		depsByKey[dep.Key()] = dep
-	}
-	liveByKey := make(map[string]lockfile.Dependency)
-	// Multi-value NWO index for transitive fuzzy matching.
-	liveByNWO := make(map[string][]lockfile.Dependency)
-	for _, dep := range liveDeps {
-		liveByKey[dep.Key()] = dep
-		liveByNWO[dep.NWO] = append(liveByNWO[dep.NWO], dep)
-	}
-
-	// Check each existing dep against live resolution.
-	for _, existing := range existingDeps {
-		if lockfile.IsFullSHA(existing.Ref) {
-			continue
-		}
-
-		live, ok := liveByKey[existing.Key()]
-		if !ok {
-			// Fuzzy match by NWO: same repo, same SHA or narrowed version.
-			if candidates, has := liveByNWO[existing.NWO]; has {
-				for _, cand := range candidates {
-					if strings.EqualFold(cand.SHA, existing.SHA) {
-						live = cand
-						ok = true
-						break
-					}
-					if IsNarrowedVersion(cand.Ref, existing.Ref) {
-						live = cand
-						ok = true
-						break
-					}
-				}
-			}
-		}
-		if !ok {
-			// Direct ref change?
-			if directNWOs[existing.NWO] {
-				if candidates, has := liveByNWO[existing.NWO]; has && len(candidates) > 0 {
-					newDep := candidates[0]
-					if newDep.Ref != existing.Ref {
-						refOwner, refRepo := existing.OwnerRepo()
-						wr.Findings = append(wr.Findings, Finding{
-							WorkflowPath: path,
-							Category:     CategoryRefChanged,
-							Severity:     SeverityWarning,
-							Dependency:   &existing,
-							ActionRef: &lockfile.ActionRef{
-								Owner: refOwner,
-								Repo:  refRepo,
-								Ref:   newDep.Ref,
-							},
-							Detail:      fmt.Sprintf("ref changed from %s to %s in workflow — re-pin to update", existing.Ref, newDep.Ref),
-							Remediation: "re-pin to match the new ref",
-						})
-						continue
-					}
-				}
-			}
-			// Transitive dep no longer discovered, or stale direct dep.
-			if !directNWOs[existing.NWO] {
-				wr.Findings = append(wr.Findings, Finding{
-					WorkflowPath: path,
-					Category:     CategoryStale,
-					Severity:     SeverityInfo,
-					Dependency:   &existing,
-					Detail:       "transitive dependency no longer discovered from upstream composite action",
-					Remediation:  "re-resolve to clean up",
-				})
-			} else {
-				wr.Findings = append(wr.Findings, Finding{
-					WorkflowPath: path,
-					Category:     CategoryStale,
-					Severity:     SeverityInfo,
-					Dependency:   &existing,
-					Detail:       "no longer in workflow — will be cleaned up",
-					Remediation:  "re-resolve to remove orphaned dependency",
-				})
-			}
-			continue
-		}
-		if !strings.EqualFold(existing.SHA, live.SHA) {
-			liveCopy := live
-			wr.Findings = append(wr.Findings, Finding{
-				WorkflowPath: path,
-				Category:     CategoryRefMoved,
-				Severity:     SeverityError,
-				Dependency:   &existing,
-				Detail:       fmt.Sprintf("pinned %s but ref now resolves to %s", existing.SHA[:12], live.SHA[:12]),
-				Remediation:  fmt.Sprintf("update to %s with `gh actions-pin upgrade`", liveCopy.SHA[:12]),
-			})
-		}
-	}
+	// Compare pinned deps against live resolution.
+	wr.Findings = append(wr.Findings, compareSnapshots(path, existingDeps, liveDeps, directNWOs)...)
 
 	// Build set of NWOs with ref-changed findings to avoid duplicate "not pinned" findings.
 	refChangedNWOs := make(map[string]bool)
@@ -270,6 +177,10 @@ func diagnoseOneWorkflow(path string, r *resolver.Resolver) WorkflowReport {
 	}
 
 	// Check for missing deps (action in workflow but not pinned).
+	depsByKey := make(map[string]lockfile.Dependency, len(existingDeps))
+	for _, dep := range existingDeps {
+		depsByKey[dep.Key()] = dep
+	}
 	for _, ref := range refs {
 		key := ref.FullName() + "@" + ref.Ref
 		if _, ok := depsByKey[key]; !ok {