Files
sim/.github
Waleed efe8a14bcc fix(ci): give push builds a base their audits can actually read (#7033)
Push builds fail the migration audit:

    ✗ Migration safety check could not run.
      Cannot diff against 'HEAD~1'.

`actions/checkout` sets no `fetch-depth`, so it defaults to 1 — a single-commit
clone in which `HEAD~1` does not resolve. Both diff-based audits named `HEAD~1`
as their push base, so neither has ever had a base to read. The migration audit
answered that with `✓ No new migrations to check` and exit 0, so it had never
run on a push build at all; #7022 made it say it could not run instead, which is
what surfaced this. The block-registry check reports `⚠ … skipping` on the same
input — visible, and equally never run.

`HEAD~1` was the wrong base regardless. It names the last commit, so a push
carrying several commits audits the tip and lets every earlier commit through:

    3-commit push, HEAD~1 base:   mig3.sql
    3-commit push, before base:   mig1.sql mig2.sql mig3.sql

The base is now `github.event.before` — the tip the branch had before the push,
which is what GitHub provides for exactly this. It is fetched by SHA at depth 1;
the audits diff two tips and need no common ancestry between them. Resolved once
in a step both audits read, so the two cannot drift apart.

`HEAD~1` survives only as the fallback for an all-zero `before` (a new branch,
with no predecessor to diff), which is what `fetch-depth: 2` now covers.

Verified: both audits accept a raw SHA base and pass; the multi-commit case above
is a real reproduction, not a description.
2026-08-24 01:12:27 -07:00
..