fix(ci): create remote-tracking ref for fork PRs in autofix verify gate

[wenshao]

Motivation

The autofix review-address verification gate fails on every fork PR. The gate runs git diff --quiet "origin/${BRANCH}...${BRANCH}" to detect whether the agent produced new commits, but fork branches are fetched via URL into FETCH_HEAD and checked out locally — the remote-tracking ref origin/${BRANCH} is never created. The resulting fatal: ambiguous argument is misread as "branch changed", and the gate then fails because address-summary.md is absent (the agent correctly wrote no-action.md).

Observed in run 29718309973, job 88279014933 for PR #7265 (fix/wake-repaint from wenshao/qwen-code).

Changes

Add git update-ref "refs/remotes/origin/${BRANCH}" "${BRANCH}" immediately after the fork checkout, so the verification gate's no-change detection works identically for fork and same-repo branches.

How to verify

Trigger an autofix review-address run against any fork PR where the agent writes no-action.md. The gate should detect "no new commits" and exit with outcome=noop instead of failing.

[yiliang114]

LGTM

[qwen-code-ci-bot]

Thanks for the PR!

Template: the body uses Motivation / Changes / How to verify instead of the template's What this PR does / Why it's needed / Reviewer Test Plan. Content is all there and clear — not blocking for a 4-line CI fix, but worth using the standard headings next time.

Problem: observed bug with evidence. The review-address verification gate at line 2448 runs git diff --quiet "origin/${BRANCH}...${BRANCH}", which fails on fork PRs because origin/${BRANCH} is never created — fork branches are fetched via URL into FETCH_HEAD. Linked CI failure: run 29718309973. ✓

Direction: aligned. This is a CI infrastructure bug fix for the autofix pipeline. No product direction concern.

Size: not applicable — .github/workflows/qwen-autofix.yml is not a core module path. 4 lines added (1 production + 3 comment).

Approach: minimal and correct. One git update-ref after the fork checkout — exactly the right fix. No scope creep.

Moving on to code review. 🔍

中文说明

感谢贡献！

模板： PR 正文使用了 Motivation / Changes / How to verify，与模板要求的 What this PR does / Why it's needed / Reviewer Test Plan 不同。内容齐全且清晰——对于 4 行的 CI 修复不构成阻塞，但建议下次使用标准标题。

问题： 已观测到的 bug，附有证据。验证门控（第 2448 行）对 fork PR 执行 git diff --quiet "origin/${BRANCH}...${BRANCH}" 时会失败，因为 fork 分支通过 URL fetch 到 FETCH_HEAD，origin/${BRANCH} 从未被创建。已关联 CI 失败记录。✓

方向： 对齐。这是 autofix 流水线的 CI 基础设施修复，无产品方向疑虑。

规模： 不适用——.github/workflows/qwen-autofix.yml 不是核心模块路径。4 行新增（1 行生产代码 + 3 行注释）。

方案： 最小且正确。在 fork checkout 后添加一行 git update-ref——恰好是正确的修复，无多余改动。

进入代码审查 🔍

— Qwen Code · qwen3.7-max

_{Reviewed at 68d6896d1672e2c9345b90f5836a558ea8fded0b · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Code Review

Independent proposal (before reading the diff): the verification gate at line 2448 uses git diff --quiet "origin/${BRANCH}...${BRANCH}" to detect whether the agent made new commits. For fork PRs, the checkout path fetches via URL into FETCH_HEAD and never creates the origin/${BRANCH} ref. The fix is to create that ref after checkout with git update-ref "refs/remotes/origin/${BRANCH}" "${BRANCH}".

PR's approach matches exactly. One line added after the fork checkout, with a clear comment explaining the purpose.

• Correctness: ✓ git update-ref creates the ref pointing to the current branch HEAD (the fork's original state before the agent runs). If the agent creates new commits, the local branch advances while origin/${BRANCH} stays fixed — git diff correctly detects the divergence. If no commits are created, both point to the same commit — git diff --quiet returns 0 and the no-action.md path executes as intended.
• Security: ✓ No concerns. ${BRANCH} comes from the CI environment (GitHub Actions workflow inputs), not untrusted user input.
• Scope: ✓ Only the fork-only code path is affected (lines 2100–2113). Same-repo PRs use git checkout -B "${BRANCH}" "origin/${BRANCH}" on a separate branch and are unaffected.
• Downstream consumers: ✓ The only consumer of origin/${BRANCH} in the review-address job is line 2448. Other diff commands use origin/main, which is always available.

No critical issues. No AGENTS.md violations.

Real-Scenario Testing

This is a CI workflow change — the fix runs inside GitHub Actions on the autofix runner, not in a local terminal. Tmux testing is not applicable here. Verification is through:

1. Gate logic analysis (above): confirmed the fix addresses the exact failure point at line 2448.
2. Git command correctness: git update-ref "refs/remotes/origin/${BRANCH}" "${BRANCH}" is a standard way to create a remote-tracking ref. The ref is created after git checkout -B "${BRANCH}" FETCH_HEAD, so ${BRANCH} exists and points to the fork HEAD.
3. CI will validate: the next autofix run against a fork PR with no-action.md will confirm outcome=noop instead of outcome=failed.

中文说明

代码审查

独立方案（阅读 diff 前）：验证门控（第 2448 行）使用 git diff --quiet "origin/${BRANCH}...${BRANCH}" 检测 agent 是否产生了新提交。对 fork PR，checkout 路径通过 URL fetch 到 FETCH_HEAD，从未创建 origin/${BRANCH} ref。修复方法是在 checkout 后用 git update-ref 创建该 ref。

PR 的方案完全一致。 在 fork checkout 后添加一行，附有清晰的注释说明目的。

• 正确性： ✓ git update-ref 将 ref 指向当前分支 HEAD（agent 运行前的 fork 原始状态）。如果 agent 创建新提交，本地分支前进而 origin/${BRANCH} 不变——git diff 正确检测分歧。如果没有新提交，两者指向同一提交——git diff --quiet 返回 0，no-action.md 路径按预期执行。
• 安全性： ✓ 无问题。${BRANCH} 来自 CI 环境（GitHub Actions 工作流输入），非不可信用户输入。
• 范围： ✓ 仅影响 fork 专用代码路径（第 2100–2113 行）。同仓库 PR 在独立分支上使用 git checkout -B "${BRANCH}" "origin/${BRANCH}"，不受影响。
• 下游消费者： ✓ review-address 任务中 origin/${BRANCH} 的唯一消费者是第 2448 行。其他 diff 命令使用 origin/main，始终可用。

无关键问题，无 AGENTS.md 违规。

真实场景测试

这是 CI 工作流变更——修复在 GitHub Actions 的 autofix runner 内运行，不在本地终端。Tmux 测试不适用。验证通过以下方式：

1. 门控逻辑分析（如上）：确认修复针对第 2448 行的精确故障点。
2. Git 命令正确性：git update-ref 是创建远程跟踪 ref 的标准方式。
3. CI 将验证：下一次针对带 no-action.md 的 fork PR 的 autofix 运行将确认 outcome=noop 而非 outcome=failed。

— Qwen Code · qwen3.7-max

_{Reviewed at 68d6896d1672e2c9345b90f5836a558ea8fded0b · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

Confidence: 5/5 — clean across every stage; minimal, correct fix for a real CI bug.

This is exactly what a good infrastructure fix looks like. The problem is real and well-documented (linked CI failure), the root cause is correctly identified (missing remote-tracking ref for fork PRs), and the fix is the minimal one-line change that makes the fork checkout path produce the same ref state that same-repo checkouts already have.

My independent proposal was identical — git update-ref after the fork checkout. The PR matches it exactly, with a clear comment explaining the purpose. No scope creep, no drive-by changes, no over-engineering.

The only minor note is the template heading mismatch (Motivation / Changes instead of What this PR does / Why it's needed), but the content is complete and the mismatch doesn't obscure anything. Not worth a round-trip for a 4-line CI fix.

Approving. ✅

中文说明

置信度：5/5 — 各阶段均通过；最小化、正确的 CI bug 修复。

这正是一个好的基础设施修复应有的样子。问题真实且有据可查（已关联 CI 失败记录），根因正确定位（fork PR 缺少远程跟踪 ref），修复方案是一行最小改动，使 fork checkout 路径产生与同仓库 checkout 一致的 ref 状态。

我的独立方案完全一致——在 fork checkout 后使用 git update-ref。PR 的方案与之完全匹配，附有清晰的注释说明目的。无范围蔓延、无顺手改动、无过度工程。

唯一的小问题是模板标题不匹配（Motivation / Changes 而非 What this PR does / Why it's needed），但内容完整，不影响理解。对于 4 行的 CI 修复，不值得为此来回修改。

批准。✅

— Qwen Code · qwen3.7-max

_{Reviewed at 68d6896d1672e2c9345b90f5836a558ea8fded0b · re-run with @qwen-code /triage}

[qwen-code-ci-bot]

LGTM, looks ready to ship. ✅

[qwen-code-ci-bot]

Released in v0.20.1.

[yiliang114]

[API Error: Connection error. (cause: fetch failed)]

---

❌ failed