fix(ci): diff merge-base in supply-chain policy guard

Merged
BN
1mo ago
+9-3

Problem

The policy-file guard diffed pull_request.base.sha → HEAD. Once main advances past a PR's branch point, that range includes main's own commits — e.g. a Cargo.lock bump on main made PR #322 look like it mixed policy and non-policy files, failing the audit even though the PR touches no policy files.

Fix

Diff git merge-base base HEAD → HEAD so only the PR's own changes are classified. Also drop --depth=1 on the base fetch — merge-base needs ancestry (checkout already uses fetch-depth: 0, so this is belt-and-suspenders for runners with shallow clones).

Policy-only PR: touches just .github/workflows/supply-chain.yml, so the guard itself should classify it as a dedicated policy PR.

Summary by cubic

Fixes the supply-chain policy guard so PRs are diffed against the merge base instead of the base tip, preventing main's own policy changes from failing unrelated PRs' audits.

  • Only the PR's own changes are classified, diffing git merge-base against the PR head rather than the merge-checkout HEAD (a synthetic merge commit where identical changes cancel out).
  • The fetch no longer passes --depth=1, since merge-base needs full ancestry.

Summary by CodeRabbit

  • Chores
    • Updated supply-chain checks to compare policy changes from the branches’ common starting point. This prevents changes made to the base branch after branching from being incorrectly included in pull request checks. These updates affect automated pull request validation; no user-facing features or behavior have changed.