From 4917f58880459dac5719d4db35c8dc6bd91bc4b4 Mon Sep 17 00:00:00 2001 From: Ben Potter Date: Tue, 11 Aug 2026 17:27:05 +0000 Subject: [PATCH 1/3] fix(.github/workflows): detect PR-changed modules via the pulls files API --- .github/workflows/module-scorecard-check.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/module-scorecard-check.yaml b/.github/workflows/module-scorecard-check.yaml index 12386dd4c..1990b592a 100644 --- a/.github/workflows/module-scorecard-check.yaml +++ b/.github/workflows/module-scorecard-check.yaml @@ -35,8 +35,6 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - name: Setup Bun uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 @@ -46,9 +44,16 @@ jobs: - name: Determine changed modules id: changed env: - BASE_SHA: ${{ github.event.pull_request.base.sha }} + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + # The PR files API is the source of truth for what a PR changes. + # Diffing against github.event.pull_request.base.sha is wrong: that + # SHA is the base tip when the PR was opened, while the checkout is + # the PR head merged into current main, so the diff picks up every + # module merged to main since the PR branched and scores unrelated + # modules (coder/registry REG-74). run: | - MODULES=$(git diff --name-only "${BASE_SHA}"...HEAD | grep -oP '^registry/coder/modules/\K[^/]+' | sort -u | paste -sd, -) + MODULES=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename' | { grep -oP '^registry/coder/modules/\K[^/]+' || true; } | sort -u | paste -sd, -) echo "modules=${MODULES}" >> "${GITHUB_OUTPUT}" echo "Changed modules: ${MODULES:-none}" From 2ae8322d8e22d95ccbf94d75b1416dd71a3f4e29 Mon Sep 17 00:00:00 2001 From: Ben Potter Date: Tue, 11 Aug 2026 17:39:34 +0000 Subject: [PATCH 2/3] fix(.github/workflows): use merge-commit parent diff instead of gh api --- .github/workflows/module-scorecard-check.yaml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/.github/workflows/module-scorecard-check.yaml b/.github/workflows/module-scorecard-check.yaml index 1990b592a..8c5e7032a 100644 --- a/.github/workflows/module-scorecard-check.yaml +++ b/.github/workflows/module-scorecard-check.yaml @@ -43,17 +43,15 @@ jobs: - name: Determine changed modules id: changed - env: - GH_TOKEN: ${{ github.token }} - PR_NUMBER: ${{ github.event.pull_request.number }} - # The PR files API is the source of truth for what a PR changes. - # Diffing against github.event.pull_request.base.sha is wrong: that - # SHA is the base tip when the PR was opened, while the checkout is - # the PR head merged into current main, so the diff picks up every + # The checkout is GitHub's test merge commit (PR head merged into + # current main), so HEAD^1 is the exact main tip this PR is applied + # to and the diff is precisely what the PR changes. Diffing against + # github.event.pull_request.base.sha is wrong: that SHA is the base + # tip from when the PR was opened, so on stale PRs it picks up every # module merged to main since the PR branched and scores unrelated - # modules (coder/registry REG-74). + # modules (REG-74). run: | - MODULES=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename' | { grep -oP '^registry/coder/modules/\K[^/]+' || true; } | sort -u | paste -sd, -) + MODULES=$(git diff --name-only HEAD^1 HEAD | { grep -oP '^registry/coder/modules/\K[^/]+' || true; } | sort -u | paste -sd, -) echo "modules=${MODULES}" >> "${GITHUB_OUTPUT}" echo "Changed modules: ${MODULES:-none}" From cdd6d6eca88810ddfd9b989c79731a2a06fd2388 Mon Sep 17 00:00:00 2001 From: Ben Potter Date: Tue, 11 Aug 2026 17:40:09 +0000 Subject: [PATCH 3/3] fix(.github/workflows): fetch merge commit parents for HEAD^1 diff --- .github/workflows/module-scorecard-check.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/module-scorecard-check.yaml b/.github/workflows/module-scorecard-check.yaml index 8c5e7032a..04beddfb3 100644 --- a/.github/workflows/module-scorecard-check.yaml +++ b/.github/workflows/module-scorecard-check.yaml @@ -35,6 +35,9 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # The merge commit plus both parents, for the HEAD^1 diff below. + fetch-depth: 2 - name: Setup Bun uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2