@@ -1,11 +1,13 @@
 package main
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/github/gh-actions-lock/cmd/gh-actions-lock/format"
 	"github.com/github/gh-actions-lock/internal/ghapi/httpmock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -275,3 +277,82 @@ jobs:
 		assert.NotContains(t, got, "$/", "opt-out means no migration to $/")
 	})
 }
+
+func TestMigrateLocalActions_UnreadableWorkflowAborts(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+	write := func(rel, content string) string {
+		full := filepath.Join(dir, rel)
+		require.NoError(t, os.MkdirAll(filepath.Dir(full), 0o755))
+		require.NoError(t, os.WriteFile(full, []byte(content), 0o644))
+		return full
+	}
+	write("local/action.yml", "runs:\n  using: composite\n")
+	const good = "jobs:\n  build:\n    steps:\n      - uses: ./local\n"
+	goodPath := write(".github/workflows/good.yml", good)
+	lockedPath := write(".github/workflows/locked.yml", good)
+	require.NoError(t, os.Chmod(lockedPath, 0o000))
+	t.Cleanup(func() { _ = os.Chmod(lockedPath, 0o644) })
+	if _, err := os.ReadFile(lockedPath); err == nil {
+		t.Skip("file permissions not enforced for this user")
+	}
+
+	total, _, err := migrateLocalActions([]string{goodPath, lockedPath})
+
+	require.Error(t, err)
+	assert.ErrorIs(t, err, os.ErrPermission)
+	assert.Zero(t, total)
+	got, readErr := os.ReadFile(goodPath)
+	require.NoError(t, readErr)
+	assert.Equal(t, good, string(got))
+}
+
+// TestMigrateLocalActions_UnparseableWorkflowIsAFinding: a workflow that
+// won't parse doesn't abort migration; it's reported like a default run.
+func TestMigrateLocalActions_UnparseableWorkflowIsAFinding(t *testing.T) {
+	reg := &httpmock.Registry{}
+	defer reg.Verify(t)
+	setupGoSHA := "4a3601121dd01d1626a1e23e37211e3254c1c06c"
+	reg.Register(
+		httpmock.GraphQLForRepo("actions", "setup-go"),
+		httpmock.JSONResponse(map[string]any{
+			"data": map[string]any{
+				"a0": testRepoResponse("actions/setup-go", setupGoSHA, nodeActionYAML),
+			},
+		}),
+	)
+
+	dir := t.TempDir()
+	write := func(rel, content string) {
+		full := filepath.Join(dir, rel)
+		require.NoError(t, os.MkdirAll(filepath.Dir(full), 0o755))
+		require.NoError(t, os.WriteFile(full, []byte(content), 0o600))
+	}
+	require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+	const good = "name: CI\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: ./.github/actions/foo\n"
+	write(".github/workflows/good.yml", good)
+	write(".github/workflows/bad.yml", "name: [\n")
+	write(".github/actions/foo/action.yml",
+		"name: Foo\nruns:\n  using: composite\n  steps:\n    - uses: actions/setup-go@v6\n")
+	t.Chdir(dir)
+
+	stdout, _, err := runCommandWithHTTP(t, reg, "--migrate-local-actions", "--json=valid,findings")
+
+	require.ErrorIs(t, err, errSilent, "the load error blocks the write like a default run")
+	var payload struct {
+		Valid    bool             `json:"valid"`
+		Findings []format.Finding `json:"findings"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(stdout), &payload))
+	assert.False(t, payload.Valid)
+	var loadErrors []string
+	for _, f := range payload.Findings {
+		if strings.Contains(f.Detail, "failed to load workflow") {
+			loadErrors = append(loadErrors, f.Workflow)
+		}
+	}
+	assert.Equal(t, []string{".github/workflows/bad.yml"}, loadErrors)
+	got, readErr := os.ReadFile(filepath.Join(dir, ".github", "workflows", "good.yml"))
+	require.NoError(t, readErr)
+	assert.Equal(t, good, string(got), "a blocked run rolls back the migration")
+}
@@ -748,8 +748,14 @@ func migrateLocalActions(paths []string) (int, func(), error) {
 		if err != nil {
 			return 0, undo, fmt.Errorf("loading %s: %w", path, err)
 		}
-		wf, err := workflowfile.Load(path)
+		// Invalid YAML can't be migrated; the scan reports it as a load
+		// finding like any other run, so skip it. Anything else aborts.
+		wf, err := workflowfile.Parse(path, original)
 		if err != nil {
+			var syntaxErr *workflowfile.SyntaxError
+			if errors.As(err, &syntaxErr) {
+				continue
+			}
 			return 0, undo, fmt.Errorf("loading %s: %w", path, err)
 		}
 		content, changed, err := wf.MigrateLocalActionsToSelfRepository()
 
@@ -21,6 +21,16 @@ import (
 
 var errPathOutsideRoot = errors.New("path resolves outside repository root")
 
+// SyntaxError reports content that isn't valid YAML, as opposed to a file
+// that couldn't be read or a document that parsed but was rejected.
+type SyntaxError struct {
+	Err error
+}
+
+func (e *SyntaxError) Error() string { return "parsing workflow YAML: " + e.Err.Error() }
+
+func (e *SyntaxError) Unwrap() error { return e.Err }
+
 // File is the parsed workflow YAML the CLI rewrites in-place.
 // It carries the original byte content alongside the parsed node tree so
 // RewriteActionRefs can do anchored, comment-preserving substitution.
@@ -47,7 +57,7 @@ func Parse(path string, content []byte) (*File, error) {
 		Content: content,
 	}
 	if err := yaml.Unmarshal(content, &f.root); err != nil {
-		return nil, fmt.Errorf("parsing workflow YAML: %w", err)
+		return nil, &SyntaxError{Err: err}
 	}
 
 	var invalid []string
 
@@ -1,6 +1,7 @@
 package workflowfile
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -734,3 +735,29 @@ func TestDiscoverCompositeActionFiles_RejectsSymlinkEscape(t *testing.T) {
 	assert.Contains(t, err.Error(), "outside repository root")
 	assert.Empty(t, paths)
 }
+
+func TestParseErrorKinds(t *testing.T) {
+	tests := []struct {
+		name       string
+		content    string
+		wantSyntax bool
+	}{
+		{name: "invalid YAML is a syntax error", content: "name: [\n", wantSyntax: true},
+		{name: "rejected uses expression is not a syntax error", content: "jobs:\n  b:\n    steps:\n      - uses: ${{ x }}\n"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := Parse("wf.yml", []byte(tt.content))
+			require.Error(t, err)
+			var syntaxErr *SyntaxError
+			assert.Equal(t, tt.wantSyntax, errors.As(err, &syntaxErr))
+		})
+	}
+}
+
+func TestLoadReadErrorIsNotASyntaxError(t *testing.T) {
+	_, err := Load(filepath.Join(t.TempDir(), "missing.yml"))
+	require.Error(t, err)
+	var syntaxErr *SyntaxError
+	assert.False(t, errors.As(err, &syntaxErr))
+}