privilegedescalation/org
12
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(detect-pipeline): fetch PR head refs and diff against HEAD

Browse Source 
Problem: --depth=1 fetch does not bring in the PR head branch name
as a ref, causing 'origin/gandalf/pri-1593-fix-main' to be unknown.

Fix: fetch all PR head refs with full refspec and diff against HEAD
instead of a non-existent remote branch ref.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Chris Farhood
2026-05-16 21:26:38 +00:00
committed by Gandalf the Greybeard [agent]
parent c3aafc3450
commit 95d8d8056d
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/detect-pr-pipeline.yaml
+5 -3
View File
@@ -23,7 +23,7 @@ jobs:
run: |
git clone --depth=1 "https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.farh.net/${{ github.repository }}.git" .
git fetch origin "$BASE_REF" --depth=1
git fetch origin "$HEAD_REF" --depth=1
git fetch origin +refs/pull/*/head:refs/pull/*/head --depth=1
git checkout "${{ github.sha }}"
- name: Run detection tests
@@ -45,13 +45,15 @@ jobs:
run: |
git clone --depth=1 "https://x-access-token:${{ secrets.GITEA_TOKEN }}@git.farh.net/${{ github.repository }}.git" .
git fetch origin "$BASE_REF" --depth=1
git fetch origin "$HEAD_REF" --depth=1
git fetch origin +refs/pull/*/head:refs/pull/*/head --depth=1
git checkout "${{ github.sha }}"
- name: Get changed files
run: |
mkdir -p /tmp/pr-detect
git diff --name-only "origin/$BASE_REF" HEAD > /tmp/pr-detect/changed_files.txt
git fetch origin "$BASE_REF" --depth=1 2>/dev/null
git fetch origin +refs/pull/*/head:refs/pull/*/head --depth=1 2>/dev/null
git diff --name-only "origin/$BASE_REF"...HEAD > /tmp/pr-detect/changed_files.txt
echo "Files found: $(wc -l < /tmp/pr-detect/changed_files.txt)"
cat /tmp/pr-detect/changed_files.txt