src/index.js:1011

• In byWorkflow grouping, sourceLocations is set from the per-workflow deduplication, but then ...cachedResult is spread afterwards. For unsupported actions, cachedResult currently includes its own sourceLocations (from the global unsupported list), which overwrites the per-workflow aggregated locations—so the summary can lose additional “found in” entries. Move the sourceLocations assignment to after the spread (or avoid storing sourceLocations in the cache) so per-workflow aggregation wins.

        workflowFile: action.workflowFile,
        sourceLocations: action.sourceLocations || [],
        supported: action.supported !== false,
        isFirstParty: action.isFirstParty || false,
        ...cachedResult
      };

src/index.js:905

• Excluded first-party actions (when includeFirstParty is false) are added to the first-party-actions output without actionPath. Since parseActionReference() now supports path-based references (e.g. github/codeql-action/init@v3), the output will lose the path for these excluded actions. Consider including actionPath here (and in the cached entry if needed) to keep output fields consistent with the checked-first-party path handling.

  // Process excluded first-party actions (no API check needed) - deduplicate by uses string
  const uniqueExcludedFirstParty = Array.from(new Map(excludedFirstPartyActions.map(a => [a.uses, a])).values());
  for (const action of uniqueExcludedFirstParty) {
    const actionInfo = {
      uses: action.uses,
      owner: action.owner,
      repo: action.repo,
      ref: action.ref,
      isFirstParty: true,
      immutable: true,
      releaseFound: false,
      message: 'Excluded (first-party)',
      allowed: true,
      excluded: true
    };