🔧 Refactor update command and move audit to upgrade

[dsyme]

Fixes #17514

Also

1. gh aw update focuses on updating workflows from source.  So it doesn't do codemods, or action updates, or gh aw update

2. gh aw upgrade does all the rest - updates gh aw version and applies codemods etc. etc.
    

Also, I will modify gh aw update to work in merge-mode by default.

---

Summary

• Simplifies update command to focus solely on fetching and merging workflow changes from source repositories; removes --merge, --pr, --no-actions, --audit, --dry-run flags and replaces opt-in --merge with opt-out --no-merge (3-way merge is now the default)
• Moves --audit and dependency health reporting to the upgrade command, where extension-level concerns (actions, agent files, codemods) already live
• Improves SHA ref handling so that commit-SHA-pinned sources now track the latest commit on the default branch instead of staying pinned forever; adds shortRef helper to abbreviate SHAs in output messages

[Copilot]

Pull request overview

Refactors the CLI so update focuses on syncing workflows from their source field (with 3-way merge as the default), while moving dependency audit and related reporting to upgrade. Also changes ref resolution behavior so branch and SHA sources can follow the latest commits more consistently, and adds shortRef for cleaner output.

Changes:

• Add --audit (and --json) support to upgrade, including a dependency health audit runner.
• Simplify update by removing several flags and making merge the default with an opt-out --no-merge.
• Change ref resolution to return SHAs for branches and to treat SHA-pinned sources as tracking the default branch; add shortRef for display.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/cli/upgrade_command.go	Adds audit/JSON flags and routes upgrade --audit to dependency reporting.
pkg/cli/update_command.go	Removes extension/actions/audit/PR/dry-run logic; keeps update focused on workflow sync + compile with --no-merge.
pkg/cli/update_workflows.go	Refactors update/merge behavior and introduces new ref resolution helpers + shortRef.
pkg/cli/update_git.go	Updates PR body text; file appears to be leftover from removed --pr functionality.
pkg/cli/update_command_test.go	Updates unit tests for new merge defaults and SHA behavior; adds shortRef test.
pkg/cli/update_integration_test.go	Adds integration tests around flags/ref resolution (some assertions missing).
docs/src/content/docs/setup/cli.md	Updates CLI docs for update --no-merge and upgrade --audit/--json.
docs/src/content/docs/guides/packaging-imports.md	Updates guide text to match new update behavior and SHA tracking description.
.github/workflows/ci.yml	Updates CI to use upgrade --audit and adjusts the update smoke step invocation.

Comments suppressed due to low confidence (1)

pkg/cli/update_workflows.go:406

• Defaulting to merge for branch-based sources is unsafe with the current base selection: when currentRef is a branch name, the “base” download uses the branch head and newContent often points to the same commit, so a 3‑way merge can preserve an outdated local file and only update the source: field. A safer approach is to force override (or require --no-merge) when the source ref is a branch until you can determine the actual base commit the local file was derived from.

	// Determine merge mode. Merge is the default behaviour — it detects
	// local modifications and performs a 3-way merge to preserve them.
	// When --no-merge is used, local changes are overridden with upstream.
	merge := !noMerge

	// When merge mode is on, detect local modifications to confirm we
	// actually need to merge (if no local mods, override is fine either way).
	if merge {
		baseContent, dlErr := downloadWorkflowContent(sourceSpec.Repo, sourceSpec.Path, currentRef, verbose)
		if dlErr == nil {
			localContent, readErr := os.ReadFile(wf.Path)
			if readErr == nil && hasLocalModifications(string(baseContent), string(localContent), wf.SourceSpec, verbose) {
				updateLog.Printf("Local modifications detected in %s, merging to preserve changes", wf.Name)
				fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("Local modifications detected in %s, merging to preserve your changes", wf.Name)))
			} else {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.