From 4d8543040ee382700d0d79a873eccfd20f71ae13 Mon Sep 17 00:00:00 2001
From: Hugh Hackman <hugh@privilegedescalation.io>
Date: Wed, 22 Apr 2026 18:15:30 +0000
Subject: [PATCH] fix: use refs/remotes/origin for branch scanning in
 stale-release-cleanup

In GitHub Actions, local branches don't exist - only remote branches
under refs/remotes/origin/. This fixes the branch scanning loop to
scan remote branches instead of local refs/heads.

Also fixes the merge-base check to use the full remote ref path.
---
 .github/workflows/stale-release-cleanup.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/stale-release-cleanup.yaml b/.github/workflows/stale-release-cleanup.yaml
index 2d43cf6..19f5481 100644
--- a/.github/workflows/stale-release-cleanup.yaml
+++ b/.github/workflows/stale-release-cleanup.yaml
@@ -33,8 +33,8 @@ jobs:
           DAYS=14
 
           # Find release branches older than 14 days not on main
-          for branch in $(git for-each-ref --format '%(refname:short)' 'refs/heads/release/*' 'refs/heads/v[0-9]*'); do
-            ts=$(git log -1 --format='%ct' "$branch")
+          for branch in $(git for-each-ref --format '%(refname:strip=3)' 'refs/remotes/origin/release/*' 'refs/remotes/origin/v[0-9]*'); do
+            ts=$(git log -1 --format='%ct' "refs/remotes/origin/$branch")
             if [ -z "$ts" ]; then
               continue
             fi
@@ -42,7 +42,7 @@ jobs:
 
             if [ "$age_days" -gt "$DAYS" ]; then
               # Check if branch has been merged into main
-              if git merge-base --is-ancestor "$branch" main 2>/dev/null; then
+              if git merge-base --is-ancestor "refs/remotes/origin/$branch" main 2>/dev/null; then
                 echo "Merged branch found: $branch (age: ${age_days}d)"
                 if [ "$DRY_RUN" == "true" ]; then
                   echo "Would delete merged branch: $branch"
@@ -62,5 +62,5 @@ jobs:
           echo "Dry run complete. No branches were deleted."
           echo ""
           echo "Release branches found:"
-          git for-each-ref --format '%(refname:short) - %(committerdate:relative)' \
-            'refs/heads/release/*' 'refs/heads/v[0-9]*' 2>/dev/null || echo "None found"
\ No newline at end of file
+          git for-each-ref --format '%(refname:strip=3) - %(committerdate:relative)' \
+            'refs/remotes/origin/release/*' 'refs/remotes/origin/v[0-9]*' 2>/dev/null || echo "None found"
\ No newline at end of file