From 62e141747506d907156da0cf99bdb1760ef0b9ba Mon Sep 17 00:00:00 2001 From: Alexander Miller Date: Tue, 29 Sep 2026 09:51:12 -0400 Subject: [PATCH 1/2] LOCAL: gate only the fork's own lines on an upstream sync PR A sync PR merges all of upstream into swaplabs/main, so the changed-code and React Doctor gates flagged upstream's own code (1052 files on the 2026-09-29 sync, for one upstream type assertion). For this repository's sync PRs (head `main` or `sync/upstream-*`), the static analysis job now sets ORCA_SYNC_PR_DIFF_BASE to where the PR meets the mirror `main`, and the diff-base resolver prefers it over the merge commit's first parent. Every other PR, and every other job, is unchanged; a failed lookup warns and gates every line. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr.yml | 17 +++++++++++++++++ config/scripts/git-pull-request-diff-base.mjs | 14 ++++++++++++-- .../scripts/git-pull-request-diff-base.test.mjs | 15 +++++++++++++++ 3 files changed, 44 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 27fc5215044d..f576c6ddb3aa 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -218,6 +218,23 @@ jobs: - uses: ./.github/actions/install-mobile-dependencies if: needs.code_paths.outputs.mobile_dependencies == 'true' + # LOCAL: a sync PR merges all of upstream into swaplabs/main, and every upstream line + # would otherwise count as changed here. Gate only the fork's own lines: those added + # since the upstream commit the PR merges, where it meets this repository's mirror `main`. + - name: Scope changed-line gates to the fork's own lines on a sync PR + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + (github.head_ref == 'main' || startsWith(github.head_ref, 'sync/upstream-')) + run: | + set -uo pipefail + if git fetch --no-tags --depth=50 origin main && + upstream="$(git merge-base HEAD FETCH_HEAD)"; then + echo "ORCA_SYNC_PR_DIFF_BASE=$upstream" >> "$GITHUB_ENV" + echo "Gating the fork's lines since upstream $upstream" + else + echo "::warning::Could not find where this sync PR meets upstream main; gating every changed line." + fi + - name: Enforce changed-code quality id: changed-code-quality background: true diff --git a/config/scripts/git-pull-request-diff-base.mjs b/config/scripts/git-pull-request-diff-base.mjs index 0dd5b825ef78..1a81ff1a9556 100644 --- a/config/scripts/git-pull-request-diff-base.mjs +++ b/config/scripts/git-pull-request-diff-base.mjs @@ -2,7 +2,12 @@ import { execFileSync } from 'node:child_process' import process from 'node:process' import { pathToFileURL } from 'node:url' -export function selectPullRequestDiffBase(requestedBase, headParents, eventName) { +export function selectPullRequestDiffBase(requestedBase, headParents, eventName, syncBase) { + // LOCAL: a SwapLabs sync PR brings in all of upstream, which upstream's own CI already gated. + // The workflow sets the upstream commit it merges so changed-line gates see only the fork's lines. + if (syncBase) { + return syncBase + } if (eventName === 'pull_request' && headParents.length >= 2) { return headParents[0] } @@ -20,7 +25,12 @@ export function resolvePullRequestDiffBase( }) .trim() .split(/\s+/) - return selectPullRequestDiffBase(requestedBase, headParents, eventName) + return selectPullRequestDiffBase( + requestedBase, + headParents, + eventName, + process.env.ORCA_SYNC_PR_DIFF_BASE + ) } // Why a CLI: the workflow's inline gates used `git diff --merge-base "$BASE_SHA" "$HEAD_SHA"`, diff --git a/config/scripts/git-pull-request-diff-base.test.mjs b/config/scripts/git-pull-request-diff-base.test.mjs index 4c1e0b8497f4..ed7ef1e24f32 100644 --- a/config/scripts/git-pull-request-diff-base.test.mjs +++ b/config/scripts/git-pull-request-diff-base.test.mjs @@ -16,4 +16,19 @@ describe('pull request diff base selection', () => { 'requested-base' ) }) + + // LOCAL: set only for the fork's own upstream sync PRs. + it('prefers the sync base over the merge commit first parent', () => { + expect( + selectPullRequestDiffBase( + 'event-base', + ['current-base', 'sync-head'], + 'pull_request', + 'upstream-tip' + ) + ).toBe('upstream-tip') + expect( + selectPullRequestDiffBase('event-base', ['current-base', 'sync-head'], 'pull_request', '') + ).toBe('current-base') + }) }) From 13b68e4d750d162433ae6891faf1ee8177d185dc Mon Sep 17 00:00:00 2001 From: Alexander Miller Date: Tue, 29 Sep 2026 10:14:18 -0400 Subject: [PATCH 2/2] LOCAL: scope the sync diff base to the two changed-line gates and to PRs into swaplabs/main Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index f576c6ddb3aa..9ca603c319ad 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -221,15 +221,18 @@ jobs: # LOCAL: a sync PR merges all of upstream into swaplabs/main, and every upstream line # would otherwise count as changed here. Gate only the fork's own lines: those added # since the upstream commit the PR merges, where it meets this repository's mirror `main`. + # Only the two changed-line gates read it; trigger checks below keep diffing against HEAD^1. - name: Scope changed-line gates to the fork's own lines on a sync PR + id: sync-pr-diff-base if: >- github.event.pull_request.head.repo.full_name == github.repository && + github.base_ref == 'swaplabs/main' && (github.head_ref == 'main' || startsWith(github.head_ref, 'sync/upstream-')) run: | set -uo pipefail if git fetch --no-tags --depth=50 origin main && upstream="$(git merge-base HEAD FETCH_HEAD)"; then - echo "ORCA_SYNC_PR_DIFF_BASE=$upstream" >> "$GITHUB_ENV" + echo "base=$upstream" >> "$GITHUB_OUTPUT" echo "Gating the fork's lines since upstream $upstream" else echo "::warning::Could not find where this sync PR meets upstream main; gating every changed line." @@ -238,9 +241,13 @@ jobs: - name: Enforce changed-code quality id: changed-code-quality background: true + env: + ORCA_SYNC_PR_DIFF_BASE: ${{ steps.sync-pr-diff-base.outputs.base }} run: pnpm run check:code-quality:changed -- "${{ github.event.pull_request.base.sha }}" - name: Enforce React Doctor on changed lines + env: + ORCA_SYNC_PR_DIFF_BASE: ${{ steps.sync-pr-diff-base.outputs.base }} run: pnpm run check:react-doctor:changed -- "${{ github.event.pull_request.base.sha }}" - wait: changed-code-quality