feat: advance profiles that cite no source

_needs_review held every skipped report, so a profile with no source_ref
never moved: anarch sat behind a CI-only commit through every bulk advance.
Its source pin now moves; its upstream pin does not, since nothing was
compared there.

scripts/profile_sync.py

@@ -1674,7 +1674,7 @@ def build_report(
     # A profile carrying no source_ref still has a pin worth writing and a
     # version worth checking, so the revisions above are resolved first.
     if not refs:
-        report.skipped = "no source_ref"
+        report.skipped = NO_SOURCE_REF
         return report
 
     owners: dict[tuple[str, int | None], tuple[RepoView, str]] = {}
@@ -3268,9 +3268,14 @@ def pending_recale(
     return pending
 
 
+NO_SOURCE_REF = "no source_ref"
+
+
 def _needs_review(report: ProfileReport, accept_changed: bool) -> bool:
     """Whether the report leaves a ref to read before the pin may move."""
-    if report.skipped or not report.head or report.pinned_tag:
+    # A profile citing nothing has nothing to read again: anarch's pin sat
+    # behind a CI-only commit through every bulk advance.
+    if report.skipped not in (None, NO_SOURCE_REF) or not report.head or report.pinned_tag:
         return True
     blocking = REVIEW_STATUSES if not accept_changed else (
         s for s in REVIEW_STATUSES if s != "CHANGED"
@@ -3309,10 +3314,13 @@ def bump_commit(
         return False
     # An upstream pinned on a release tag is the base the port was cut from:
     # its HEAD is another program, so the bump leaves it on the tag.
+    # A profile citing nothing compared nothing upstream: writing that HEAD
+    # would claim gme's vendored libgme or hbmame's port is current.
     upstream_moves = bool(
         report.upstream_head
         and report.upstream_pin != report.upstream_head
         and not report.upstream_tag
+        and report.skipped != NO_SOURCE_REF
     )
     if document.get("source_commit") == report.head and not upstream_moves:
         # Rewriting the pin to the value it already holds is not a bump, and

tests/test_profile_sync.py

@@ -3122,6 +3122,27 @@ class TestBumpCommit(unittest.TestCase):
         self.assertEqual(profile_sync.pending_recale(report), 1)
         self.assertFalse(bump_commit(self.path, report))
 
+    def test_a_profile_citing_nothing_advances(self):
+        # anarch's pin sat behind HEAD through every bulk advance: the
+        # report skips a profile with no source_ref, and the skip blocked it.
+        report = ProfileReport(
+            name="p", repo="o/n", pin="pin", head="newhead", entries=[], counts={},
+            skipped=profile_sync.NO_SOURCE_REF,
+        )
+        report.upstream_head, report.upstream_pin = "uphead", "uppin"
+        self.assertTrue(bump_commit(self.path, report))
+        text = self.path.read_text(encoding="utf-8")
+        self.assertIn("newhead", text)
+        # Nothing was compared upstream, so its pin is not written.
+        self.assertNotIn("uphead", text)
+
+    def test_any_other_skip_still_holds_the_pin(self):
+        report = ProfileReport(
+            name="p", repo="o/n", pin="pin", head="newhead", entries=[], counts={},
+            skipped="rate limited: gitlab.com",
+        )
+        self.assertFalse(bump_commit(self.path, report))
+
     def test_accepted_when_nothing_had_to_move(self):
         part = PartResult(
             RefPart("a.c", 10, 12, "a.c:10-12"), "ANCHORED", None, 10, 12, []