From b6eb7af0017c094e16a52af9a68d79df970f73b9 Mon Sep 17 00:00:00 2001 From: Aryan Date: Sat, 1 Aug 2026 10:01:03 +0530 Subject: [PATCH 1/2] fix(ci): resolve PR diff bases live instead of the stale payload SHA (#10785) Three workflows still diffed against github.event.pull_request.base.sha, which is only as fresh as the last event that populated it: a queued or re-triggered run can diff against a base the target branch has since moved past, silently widening or narrowing diff-scoped check selection (FC-stale-event-payload-diff-base, registered after #10784 / PR #10758). Switch all three to the canonical prevention: resolve origin/ live against the fetch-depth:0 checkout in the same job, matching the detect-changes action used by repo-checks.yml. - backend-unit-tests.yml: changed-files base - desktop-swift-ci.yml: DIFF_BASE for path detection - backend-hermetic-e2e.yml: PR_BASE_REF for hermetic scope The fourth call site named in the issue (desktop-backend-image-checks.yml) was removed with the retired Node agent cloud, so only three remain. Failure-Class: FC-stale-event-payload-diff-base Co-authored-by: CommandCodeBot --- .github/workflows/backend-hermetic-e2e.yml | 7 +++++-- .github/workflows/backend-unit-tests.yml | 5 ++++- .github/workflows/desktop-swift-ci.yml | 5 ++++- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/backend-hermetic-e2e.yml b/.github/workflows/backend-hermetic-e2e.yml index 8091cc0d736..4ea9f3f0d16 100644 --- a/.github/workflows/backend-hermetic-e2e.yml +++ b/.github/workflows/backend-hermetic-e2e.yml @@ -32,11 +32,14 @@ jobs: shell: bash env: EVENT_NAME: ${{ github.event_name }} - PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} + # Resolve the PR base live against the checkout (matching + # detect-changes) rather than the event-payload base.sha, which can be + # stale for a queued run (FC-stale-event-payload-diff-base, #10785). + PR_BASE_REF: origin/${{ github.base_ref }} MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }} run: | case "$EVENT_NAME" in - pull_request) base_sha="$PR_BASE_SHA" ;; + pull_request) base_sha="$PR_BASE_REF" ;; merge_group) base_sha="$MERGE_GROUP_BASE_SHA" ;; workflow_dispatch) echo "applies=true" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/backend-unit-tests.yml b/.github/workflows/backend-unit-tests.yml index 493da0eeff4..45d8763d0f6 100644 --- a/.github/workflows/backend-unit-tests.yml +++ b/.github/workflows/backend-unit-tests.yml @@ -135,7 +135,10 @@ jobs: working-directory: backend run: | if [[ "${{ github.event_name }}" == "pull_request" ]]; then - ../scripts/changed-files "${{ github.event.pull_request.base.sha }}"...HEAD > /tmp/backend-changed-files.txt + # Resolve the base live against the checkout (matching detect-changes) + # rather than the event-payload base.sha, which can be stale for a + # queued run (FC-stale-event-payload-diff-base, #10785). + ../scripts/changed-files "origin/${{ github.base_ref }}"...HEAD > /tmp/backend-changed-files.txt bash scripts/run-unit-ci.sh --changed-files /tmp/backend-changed-files.txt else bash scripts/run-unit-ci.sh --all diff --git a/.github/workflows/desktop-swift-ci.yml b/.github/workflows/desktop-swift-ci.yml index b5d063082bc..5c860ec6ab9 100644 --- a/.github/workflows/desktop-swift-ci.yml +++ b/.github/workflows/desktop-swift-ci.yml @@ -35,7 +35,10 @@ jobs: id: changed run: | if [ "${{ github.event_name }}" = "pull_request" ]; then - DIFF_BASE="${{ github.event.pull_request.base.sha }}" + # Resolve the base live against the checkout (matching detect-changes) + # rather than the event-payload base.sha, which can be stale for a + # queued run (FC-stale-event-payload-diff-base, #10785). + DIFF_BASE="origin/${{ github.base_ref }}" else DIFF_BASE="${{ github.event.before }}" fi From b3bfe0b78f5a2696a6b2a53e4a749eeb168d8077 Mon Sep 17 00:00:00 2001 From: Aryan Date: Sat, 1 Aug 2026 10:17:18 +0530 Subject: [PATCH 2/2] test(ci): assert the hermetic scope resolves the PR base live The scope step now diffs against origin/ (live, matching detect-changes) instead of the event-payload base.sha which can be stale for a queued run (FC-stale-event-payload-diff-base, #10785). Update the wiring contract test to assert the new PR_BASE_REF pattern and that the stale base.sha reference is gone. Co-authored-by: CommandCodeBot --- backend/tests/unit/test_listen_pusher_stack_ci_wiring.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/tests/unit/test_listen_pusher_stack_ci_wiring.py b/backend/tests/unit/test_listen_pusher_stack_ci_wiring.py index 6178119095a..59d16ed8906 100644 --- a/backend/tests/unit/test_listen_pusher_stack_ci_wiring.py +++ b/backend/tests/unit/test_listen_pusher_stack_ci_wiring.py @@ -91,7 +91,11 @@ def test_backend_hermetic_gate_is_always_reported_and_fails_closed() -> None: assert ' scope:\n' in workflow scope = workflow.split(' scope:\n', 1)[1].split('\n hermetic-e2e:\n', 1)[0] - assert 'github.event.pull_request.base.sha' in scope + # The PR base is resolved live against the checkout (origin/) rather + # than the event-payload base.sha, which can be stale for a queued run + # (FC-stale-event-payload-diff-base, #10785). + assert 'github.event.pull_request.base.sha' not in scope + assert 'PR_BASE_REF: origin/${{ github.base_ref }}' in scope assert 'github.event.merge_group.base_sha' in scope assert 'git diff --name-only "$base_sha"...HEAD' in scope assert "^(backend/|package\\.json$|package-lock\\.json$|\\.github/workflows/backend-hermetic-e2e\\.yml$)" in scope