From 09f2e0e5a177da565a9a7cab171b16eac022be31 Mon Sep 17 00:00:00 2001
From: Leon Silcott <leon@boasi.io>
Date: Thu, 3 Sep 2026 12:56:33 +0100
Subject: [PATCH] ci: check SP11 topic source changes per commit

Keep the existing beta-wide integration report so historical findings remain visible, but derive the current beta tip and real topic head from the pull-request checkout's synthetic merge. Review each new topic commit independently and reject any new source-level checkpatch error, warning, or check.

Require topic heads to descend from the current beta tip and reject merge commits in the topic range. This makes the reviewed delta exact and forces a relift after beta advances.

Signed-off-by: Leon Silcott <leon@boasi.io>
---
 .github/scripts/check-sp11-integration.sh | 84 +++++++++++++++++++----
 1 file changed, 71 insertions(+), 13 deletions(-)

diff --git a/.github/scripts/check-sp11-integration.sh b/.github/scripts/check-sp11-integration.sh
index 09b679a4053505..cec4fada2b72d7 100755
--- a/.github/scripts/check-sp11-integration.sh
+++ b/.github/scripts/check-sp11-integration.sh
@@ -86,22 +86,23 @@ for path in "${all_changed_paths[@]}"; do
 	esac
 done
 
+kernel_pathspecs=(
+	':(top,glob)**/*.c'
+	':(top,glob)**/*.h'
+	':(top,glob)**/*.S'
+	':(top,glob)**/*.rs'
+	':(top,glob)**/*.dts'
+	':(top,glob)**/*.dtsi'
+	':(top,glob)**/*.patch'
+	':(top,glob)arch/*/configs/**'
+	':(top,glob)**/Kconfig*'
+	':(top,glob)**/Makefile'
+	':(top,glob)Documentation/devicetree/bindings/**/*.yaml'
+)
+
 if [[ "${kernel_changed}" == true ]]; then
 	[[ -x scripts/checkpatch.pl ]] ||
 		die "scripts/checkpatch.pl is required for kernel-source changes"
-	kernel_pathspecs=(
-		':(top,glob)**/*.c'
-		':(top,glob)**/*.h'
-		':(top,glob)**/*.S'
-		':(top,glob)**/*.rs'
-		':(top,glob)**/*.dts'
-		':(top,glob)**/*.dtsi'
-		':(top,glob)**/*.patch'
-		':(top,glob)arch/*/configs/**'
-		':(top,glob)**/Kconfig*'
-		':(top,glob)**/Makefile'
-		':(top,glob)Documentation/devicetree/bindings/**/*.yaml'
-	)
 	# File changes are reviewed, but their generic MAINTAINERS reminder is
 	# not a style defect. Some extracted commits preserve a contributor as
 	# nominal author while carrying only the submitter's authorized sign-off;
@@ -119,4 +120,61 @@ else
 	printf 'No kernel-source changes require checkpatch.pl.\n'
 fi
 
+review_base="${SP11_REVIEW_BASE:-}"
+review_head="${SP11_REVIEW_HEAD:-}"
+
+if [[ -z "${review_base}" && -z "${review_head}" &&
+	"${GITHUB_EVENT_NAME:-}" == "pull_request" ]]; then
+	merge_and_parents=()
+	read -r -a merge_and_parents <<<"$(git rev-list --parents -n 1 HEAD)"
+	((${#merge_and_parents[@]} == 3)) ||
+		die "pull-request checkout is not a two-parent synthetic merge"
+	review_base="${merge_and_parents[1]}"
+	review_head="${merge_and_parents[2]}"
+fi
+
+if [[ -n "${review_base}" || -n "${review_head}" ]]; then
+	[[ -n "${review_base}" && -n "${review_head}" ]] ||
+		die "SP11_REVIEW_BASE and SP11_REVIEW_HEAD must be provided together"
+
+	git cat-file -e "${review_base}^{commit}" 2>/dev/null ||
+		die "pull-request base commit is unavailable: ${review_base}"
+	git cat-file -e "${review_head}^{commit}" 2>/dev/null ||
+		die "pull-request head commit is unavailable: ${review_head}"
+	# Topic PRs are deliberately re-lifted onto the current beta tip. This
+	# keeps each review delta exact and prevents a green check from masking a
+	# stale topic that has never been tested against newly integrated work.
+	git merge-base --is-ancestor "${review_base}" "${review_head}" ||
+		die "pull-request head must be re-lifted onto the current beta tip"
+
+	review_count=0
+	while IFS= read -r commit; do
+		commit_and_parents=()
+		read -r -a commit_and_parents <<<"$(git rev-list --parents -n 1 "${commit}")"
+		((${#commit_and_parents[@]} == 2)) ||
+			die "topic range must be linear; merge commit found: ${commit}"
+
+		parent="${commit_and_parents[1]}"
+		review_count=$((review_count + 1))
+		if git diff --quiet "${parent}" "${commit}" -- "${kernel_pathspecs[@]}"; then
+			continue
+		fi
+
+		commit_checkpatch_output="$(
+			git diff --no-ext-diff "${parent}" "${commit}" -- \
+				"${kernel_pathspecs[@]}" |
+				scripts/checkpatch.pl --no-tree --strict --show-types \
+					--ignore FILE_PATH_CHANGES,NO_AUTHOR_SIGN_OFF - || true
+		)"
+		printf '%s\n' "${commit_checkpatch_output}"
+		if grep -qE '^(ERROR|WARNING|CHECK):' <<<"${commit_checkpatch_output}"; then
+			die "per-commit source checkpatch findings in ${commit}"
+		fi
+	done < <(git rev-list --reverse "${review_base}..${review_head}")
+
+	((review_count > 0)) || die "pull request contains no topic commits"
+	printf 'Per-commit source checks passed for %d topic commits.\n' \
+		"${review_count}"
+fi
+
 printf 'Surface Pro 11 integration checks passed for %s.\n' "$(git rev-parse HEAD)"