Skip to content

ci(guard): find the merge base on a shallow checkout and fail closed when it cannot #359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chris-Wolfgang merged 1 commit into from
Sep 19, 2026
Merged

ci(guard): find the merge base on a shallow checkout and fail closed when it cannot #359

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion .github/workflows/pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,11 @@ jobs:
# in their own PRs; it does not apply to a trusted GitHub-controlled bot whose
# only action is package-version updates.
if: github.event.pull_request.user.login != 'dependabot[bot]'
env:
PR_NUMBER: ${{ github.event.pull_request.number }}
# persist-credentials:false on the checkout, so the deepening fetch below needs the
# job token for a private repository. Used on this one command only; never stored.
TRUSTED_MAIN_URL: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}
run: |
echo "Checking for changes to protected configuration files in this PR..."

Expand All @@ -189,7 +194,18 @@ jobs:
# a PR that *deletes* a workflow or .globalconfig is as security-relevant as an
# edit. -i: Windows (and ReSharper on it) resolve names case-insensitively, so
# foo.dotsettings is as live as foo.DotSettings.
mapfile -t all_changed < <(git diff --name-only --diff-filter=AMRCD main-branch...HEAD 2>/dev/null)
# The checkout is shallow (depth 1); the PR's own history is needed to find the
# merge base. Deepen until one exists, then diff against it. Fail closed: a guard
# that cannot compute the diff must not report "nothing changed".
for _ in 1 2 3 4 5 6; do
git merge-base main-branch HEAD >/dev/null 2>&1 && break
git fetch --quiet --deepen=50 "$TRUSTED_MAIN_URL" "refs/pull/$PR_NUMBER/head" 2>/dev/null || true
done
if ! base=$(git merge-base main-branch HEAD 2>/dev/null); then
echo "::error::Cannot find the merge base between main and the PR head - refusing to classify the change."
exit 1
fi
mapfile -t all_changed < <(git diff --name-only --diff-filter=AMRCD "$base" HEAD)
protected=(); other=()
for file in "${all_changed[@]}"; do
case "$file" in
Expand Down
Loading