Submodule guard: ask GitHub when a shallow clone hides ancestry

scripts/ci/submodule_forward_only.py

@@ -56,6 +56,11 @@ def local_relation(path: str, base: str, new: str) -> str | None:
         return "forward"
     if backward.returncode == 0:
         return "backward"
+    # A shallow clone can hold both commits without the history joining
+    # them, so neither ancestry check succeeding proves nothing there.
+    shallow = run("git", "-C", path, "rev-parse", "--is-shallow-repository")
+    if shallow.returncode != 0 or shallow.stdout.strip() != "false":
+        return None
     base_exists = run("git", "-C", path, "cat-file", "-e", f"{base}^{{commit}}")
     new_exists = run("git", "-C", path, "cat-file", "-e", f"{new}^{{commit}}")
     if base_exists.returncode == 0 and new_exists.returncode == 0:

tests/test_submodule_forward_only.py

@@ -134,6 +134,18 @@ def test_undecidable_ancestry_fails(self) -> None:
         self.assertNotEqual(result.returncode, 0)
         self.assertIn("could not determine ancestry", result.stderr)
 
+    def test_shallow_clone_does_not_report_a_forward_bump_as_diverged(self) -> None:
+        # CI checks out submodules shallowly: both pinned commits are present
+        # but the history joining them is not, so a failed ancestry check
+        # proves nothing and must defer to the GitHub compare.
+        b = self.commit_sub("pinned on main")
+        c = self.commit_sub("pinned on the branch")
+        shallow = self.root / "shallow"
+        git("clone", "-q", "--depth", "1", f"file://{self.subrepo}", str(shallow), cwd=self.root)
+        git("fetch", "-q", "--depth", "1", "origin", b, cwd=shallow)
+
+        self.assertNotEqual(submodule_forward_only.local_relation(str(shallow), b, c), "diverged")
+
     def test_declared_rollback_passes(self) -> None:
         b = self.commit_sub("intentional rollback")
         self.pointer(b)