fix(ci): resolve PR diff bases live instead of the stale payload SHA (#10785)

[aryanorastar]

Fixes #10785

What changed and why

Three workflows still diffed against github.event.pull_request.base.sha, which is only as fresh as the last event that populated it. A queued or metadata-re-triggered run can diff against a base the target branch has since moved past — silently widening or narrowing diff-scoped check selection. This is exactly the FC-stale-event-payload-diff-base failure class registered after #10784 (which fixed repo-checks.yml after PR #10758 hit a false invariant-citation failure).

All three now resolve the base live against the fetch-depth: 0 checkout in the same job, matching the detect-changes action's canonical pattern (origin/<base-ref>):

• .github/workflows/backend-unit-tests.yml — changed-files base for the authoritative backend unit contract.
• .github/workflows/desktop-swift-ci.yml — DIFF_BASE for Swift path detection.
• .github/workflows/backend-hermetic-e2e.yml — PR_BASE_REF for hermetic backend scope.

The fourth call site named in the issue (desktop-backend-image-checks.yml) was removed with the retired Node agent cloud, so only three remain.

Product invariants affected

None (CI workflow changes only).

How it was verified

• actionlint .github/workflows/{backend-unit-tests,desktop-swift-ci,backend-hermetic-e2e}.yml — clean.
• grep -rn "event.pull_request.base.sha" .github/workflows/ — no remaining usages.
• python3 .github/scripts/check_deployment_secret_boundary.py --base origin/main — passed.
• python3 .github/scripts/check_runner_cost_policy.py — passed.
• scripts/failure-class prepare — declaration validated.

Tests

No test change — this is CI workflow diff-base resolution. The regression guard is the failure-class contract (FC-stale-event-payload-diff-base) plus the detect-changes action's existing behavior, which these now match.

Failure class (fixes)

Failure-Class: FC-stale-event-payload-diff-base

Scoped cleanups

None.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[Git-on-my-level]

Thanks for tracking down the stale event-payload base issue here. I reviewed the workflow diffs and this looks like the right direction: the changed jobs already use fetch-depth: 0, the new origin/${{ github.base_ref }} base is kept quoted, merge-group/manual paths stay unchanged, and the regression assertion for the hermetic backend scope now prevents reintroducing github.event.pull_request.base.sha there.

I’m not seeing a blocker in the patch, and the current CI is green. Because this touches CI/workflow behavior and is tied to an earlier failure class, I’m leaving it for human maintainer review rather than formal automated approval.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[aryanorastar]

Independently verified the final head (af679b9 → 3b2b687):

• actionlint: clean on backend-unit-tests.yml, desktop-swift-ci.yml, backend-hermetic-e2e.yml (the only shellcheck finding, SC2004, is pre-existing in an untouched step).
• Stale-base eradication: git grep event.pull_request.base.sha across all workflows on this branch returns nothing — zero remaining stale-payload bases.
• Contract test: swapped the branch's 3 workflows + test file in and ran the hermetic gate tests → 3 passed (asserts PR_BASE_REF: origin/${{ github.base_ref }} and absence of the stale payload SHA). Restored working tree afterward (clean against HEAD).
• Preserved paths: merge_group (base_sha) and workflow_dispatch (github.event.before) branches are untouched — only the pull_request path was fixed, so queued/re-triggered runs can no longer drift.
• CI is green on this head (20 success / 9 skipped).

@cubic-dev-ai's review was 5/5 / no issues; your note on not needing another cubic pass is correct. @Git-on-my-level confirmed no blocker from automation and CI is green.

This is a correct, minimal stale-diff-base fix (FC-stale-event-payload-diff-base). Still needs your human maintainer sign-off on the workflow behavior change (needs-maintainer-review / workflow-review).

[aryanorastar]

Rebased the actual PR branch onto latest main before rerun. The previous Desktop Swift failure was isolated to ChatTranscriptGestureHarnessTests.testSendStartingWhileTheReaderScrollsDoesNotSeizeTheViewport, unrelated to this workflow-only diff. The updated head should rerun against the current desktop test baseline.

[aryanorastar]

@Git-on-my-level need human response — this is still blocked on code-owner review for CI/workflow behavior.

Your earlier AI pass was a positive signal (no blocker): jobs already use fetch-depth: 0, bases resolve to quoted origin/${{ github.base_ref }}, merge-group/manual paths stay unchanged, and the hermetic scope regression asserts against the live base. Cubic was 5/5 / no issues. Current head b3bfe0b7 is CI green (22 pass).

What’s left is the formal human / workflow-review sign-off, or an explicit hold if something else is blocking. Happy to follow up immediately either way.

[aryanorastar]

@Git-on-my-level quick follow-up: PR #10964 remains CI-green at b3bfe0b with Cubic 5/5 and your earlier positive signal. The only remaining merge blocker is the required workflow code-owner approval; no code or CI changes are pending.

[aryanorastar]

@Git-on-my-level need human response — workflow code-owner APPROVE still the only merge blocker on #10964.

Refreshed tip 477a825 = merge of current main onto the live-diff-base fix (no conflicts). Still:

• origin/${{ github.base_ref }} on the three PR paths (backend-unit-tests, desktop-swift-ci, backend-hermetic-e2e)
• zero remaining github.event.pull_request.base.sha in workflows
• hermetic scope regression test still asserts the live base
• merge-group / workflow_dispatch paths untouched
• Failure-Class: FC-stale-event-payload-diff-base

Your earlier AI pass found no blocker; Cubic 5/5. Please human / workflow-review APPROVE (or explicit hold) when you can.

[aryanorastar]

@Git-on-my-level need human response — Desktop Swift red on 477a825 was the same stale glass tripwires as #11142 (not this workflow diff).

Merged current main on tip 9cb3c87f8d94 so AgentPill minimumHeight + HelpPage forKeyPath contracts match. Live-diff-base fix unchanged:

• origin/${{ github.base_ref }} on the three PR paths
• zero github.event.pull_request.base.sha
• Failure-Class: FC-stale-event-payload-diff-base

Please human / workflow-review APPROVE (or explicit hold) when CI re-greens.

[aryanorastar]

@Git-on-my-level need human response — #10964 still blocked only on CI/workflow code-owner APPROVE.

Author-clear on tip 9cb3c87f8d:

• CI green (incl. Desktop Swift after main refresh cleared the glass tripwires)
• MERGEABLE
• Your earlier AI pass: no blocker (origin/${{ github.base_ref }}, merge-group/dispatch untouched, hermetic regression asserts live base)
• Cubic 5/5; Failure-Class: FC-stale-event-payload-diff-base
• No author tip pending

Please human / workflow-review APPROVE (or explicit hold) when you can.

[Git-on-my-level]

Thanks for keeping this focused. I re-reviewed the current head and I don’t see a code blocker in this CI/workflow diff.

Specific notes:

• .github/workflows/backend-hermetic-e2e.yml: the scope job already checks out with fetch-depth: 0, and switching the PR case from the event payload SHA to PR_BASE_REF: origin/${{ github.base_ref }} keeps the existing git cat-file guard and git diff --name-only "$base_sha"...HEAD path gate intact. Merge-group and manual dispatch behavior are unchanged.
• .github/workflows/backend-unit-tests.yml: the authoritative backend unit contract now feeds scripts/changed-files with origin/${{ github.base_ref }}...HEAD; this matches the helper’s merge-commit handling and avoids relying on a queued event payload SHA.
• .github/workflows/desktop-swift-ci.yml: the desktop change detector uses the same live base ref while preserving the non-PR fallback to github.event.before / HEAD^, so the Swift manifest/test selection path remains structurally the same.
• backend/tests/unit/test_listen_pusher_stack_ci_wiring.py: the regression guard now asserts the stale github.event.pull_request.base.sha reference is absent from the hermetic scope and that the new PR_BASE_REF wiring is present, which covers the backend hermetic workflow change.

Validation I checked locally/static:

• PR head still matches 9cb3c87f8d94657313efef7f15b2e493f578874d.
• No remaining github.event.pull_request.base.sha references under .github/workflows at this head.
• Focused static assertions for the three workflow substitutions pass.
• I could not run the focused pytest module in this checkout because local test dependencies are missing (google import from backend/tests/unit/conftest.py), but the GitHub checks for the PR are green, including the backend unit suite and workflow-related gates.

Because this touches CI/workflow behavior, I’m leaving it for human workflow-owner/code-owner sign-off rather than formal automation approval.

— Reviewed by Omi maintainer automation (glm-5.2)

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[aryanorastar]

@Git-on-my-level need human response — formal workflow/code-owner APPROVE is still the only merge blocker on #10964.

Author-clear on tip 9cb3c87f8d:

• MERGEABLE · CI green (22 pass / 7 skipped)
• Your latest AI re-review (minutes ago): no code blocker — live origin/${{ github.base_ref }} on the three PR paths; merge-group/dispatch untouched; hermetic regression asserts absence of github.event.pull_request.base.sha
• Cubic 5/5 · Failure-Class: FC-stale-event-payload-diff-base
• No author tip pending

Please human / workflow-review APPROVE (or explicit hold) when you can.

[aryanorastar]

@Git-on-my-level @undivisible review ping — this one is ready and has been waiting 1 day.

MERGEABLE, no failing checks on the current head. It resolves PR diff bases live instead of the stale payload SHA (#10785).

Blocked only on workflow CODEOWNER approval — .github/workflows/** requires your sign-off per CODEOWNERS, so I can't move it myself.

One thing worth flagging so it isn't read as red: the Hygiene / Formatting / PR Metadata Preflight entries showing CANCELLED are from 2026-08-10 and were superseded by SUCCESS runs on the same head (9cb3c87f) later that day and on 08-11. The head has not moved since. Nothing is actually failing.

---

_{Still current and still author-side clear. Verified against main on 2026-08-23: not superseded, still MERGEABLE, all checks green, no conflicts. Blocker is the CODEOWNERS workflow-review routing. Grouped with six sibling CI PRs in one consolidated ping at #10959 rather than bumping each thread separately.}