ci: shallow-checkout candidate complexity independently of trusted policy

[teamleaderleo]

Candidate web-complexity runs fetch the entire repository history before determining whether web files changed. In the September 20 15:30–17:30 UTC creation cohort, candidate checkout steps consumed 117.87 of 121.87 allocated runner-minutes. This PR extracts the candidate-only portion of #13171 so it can land independently of that PR's protected trusted-workflow update.

Use a depth-one checkout and fetch only the exact PR base or pre-push commit when absent. Missing or invalid comparison commits fail rather than dropping the baseline comparison. Initial pushes need no comparison fetch. The trusted workflow and checker bytes are unchanged; required-check names, events and policy remain unchanged.

The real-Git regression suite runs in the existing workflow-guard job, not every candidate complexity invocation. This also addresses the test-placement concern on #13171 without editing that PR's branch.

Validation: regression-only commit fails three of four cases; the final implementation passes all four real shallow-repository cases (older base across a multi-commit push, HEAD/history preservation, already-present commit without network, initial push and invalid/unavailable revisions). Trusted workflow isolation and merge-queue required-check topology checks pass. Bash syntax, actionlint and git diff checks pass. The canonical checkout's branch and index were preserved using a private Git index. No native build is needed for this workflow-only change; CI will validate the published head. The exposure above is not a measured latency or dollar saving for this patch.

---

Summary by cubic

Candidate web-complexity runs now use a shallow checkout so they no longer fetch the entire repository history before detecting web changes. The workflow fetches only the exact PR base or pre-push commit when it isn't already present, and invalid or unavailable comparison revisions fail instead of silently dropping the baseline; initial pushes skip the fetch. Trusted workflow checks, checker bytes, and required-check names are unchanged.

Adds a fetch-script regression suite that runs in the existing workflow-guard job and exercises real shallow repositories, covering older bases across multi-commit pushes, HEAD/history preservation, already-present commits without network, initial pushes, and invalid/unavailable revisions.

^{Written for commit 83bba7c. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9c273179-2e26-4be0-95d9-1246e4dacef4

📥 Commits

Reviewing files that changed from the base of the PR and between 7ad0c99 and 83bba7c.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/web-complexity.yml
• scripts/ci/fetch-complexity-base.sh
• tests/test_ci_fetch_complexity_base.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the shallow-fetch behavior preserves required comparisons and is covered across the relevant success and failure cases.

Summary

Switches candidate web-complexity checks from a full-history checkout to a depth-one checkout while preserving reliable baseline comparisons.

• Fetches only the exact pull-request base or pre-push revision when it is absent locally.
• Validates comparison revisions as full commit SHAs and fails when a required commit cannot be fetched.
• Skips comparison fetching for initial pushes.
• Adds real-Git regression coverage to the existing workflow-guard job.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Candidate web-complexity workflow] --> B[Depth-one checkout]
  B --> C{Comparison SHA empty or all zeros?}
  C -->|Yes| D[Initial push: skip comparison fetch]
  C -->|No| E{Valid full commit SHA?}
  E -->|No| F[Fail workflow]
  E -->|Yes| G{Commit already available?}
  G -->|Yes| I[Verify commit]
  G -->|No| H[Fetch exact commit at depth one]
  H --> I
  I --> J[Detect web changes and compare baseline]

Loading

_{Reviews (3) · Last reviewed commit: "Merge current main into shallow complexi..."}