From 13d2252372d742cb123e2317c5c571ee76d64746 Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:38:02 +0900
Subject: [PATCH 1/6] fix: fetch gate comparison revisions before source
 checkout

---
 .github/workflows/quality-gate.yml | 12 ++++++++++++
 tests/test_workflow_wiring.py      |  8 ++++++++
 2 files changed, 20 insertions(+)

diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index e807cac..3ba6a71 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -54,6 +54,18 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
+      - name: Fetch gate comparison revisions
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$BASE_SHA" =~ ^[0-9a-f]{40}$ || ! "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo 'Unable to resolve gate comparison revisions.' >&2
+            exit 1
+          fi
+          git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
       - name: Check out quality gate implementation
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index e1a1ba2..74a6160 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -31,6 +31,14 @@ def test_quality_gate_resolves_source_once_and_never_checks_out_main(self) -> No
         self.assertIn("source_sha", source)
         self.assertRegex(source, r"ref:\s*\$\{\{[^}]*source_sha[^}]*\}\}")
 
+    def test_comparison_revisions_are_fetched_before_source_checkout(self) -> None:
+        source = QUALITY_GATE.read_text()
+        fetch_index = source.index("name: Fetch gate comparison revisions")
+        source_checkout_index = source.index("name: Check out quality gate implementation")
+
+        self.assertLess(fetch_index, source_checkout_index)
+        self.assertIn('git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"', source)
+
     def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
         source = ORG_CALLER.read_text()
         self.assertRegex(source, r"(?m)^\s*actions:\s*read\s*$")

From aaea8574a2a490c82076f42053e7465969af8fe4 Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:38:23 +0900
Subject: [PATCH 2/6] security: pin gate caller to comparison fetch fix

---
 .github/workflows/org-quality-gate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index ef2de8e..bbcf98b 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@16a8f9b0b224c8e1483afac86ea9a00636d777d0
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@13d2252372d742cb123e2317c5c571ee76d64746
     with:
-      source-ref: 16a8f9b0b224c8e1483afac86ea9a00636d777d0
+      source-ref: 13d2252372d742cb123e2317c5c571ee76d64746
       linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest

From c088ff9883a0d6b861c4f11f91f2c57207aefd26 Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:47:11 +0900
Subject: [PATCH 3/6] fix: mark container workspace safe for revision fetch

---
 .github/workflows/quality-gate.yml | 2 +-
 tests/test_workflow_wiring.py      | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index 3ba6a71..2fb3531 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -65,7 +65,7 @@ jobs:
             echo 'Unable to resolve gate comparison revisions.' >&2
             exit 1
           fi
-          git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
+          git -c safe.directory="$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
       - name: Check out quality gate implementation
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index 74a6160..f49ace2 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -37,7 +37,11 @@ def test_comparison_revisions_are_fetched_before_source_checkout(self) -> None:
         source_checkout_index = source.index("name: Check out quality gate implementation")
 
         self.assertLess(fetch_index, source_checkout_index)
-        self.assertIn('git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"', source)
+        self.assertIn(
+            'git -c safe.directory="$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin '
+            '"$BASE_SHA" "$HEAD_SHA"',
+            source,
+        )
 
     def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
         source = ORG_CALLER.read_text()

From e56b79590c9015124e42afd132eae4a17d6e0db3 Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:47:25 +0900
Subject: [PATCH 4/6] security: pin caller to container-safe fetch fix

---
 .github/workflows/org-quality-gate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index bbcf98b..eba0682 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@13d2252372d742cb123e2317c5c571ee76d64746
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@c088ff9883a0d6b861c4f11f91f2c57207aefd26
     with:
-      source-ref: 13d2252372d742cb123e2317c5c571ee76d64746
+      source-ref: c088ff9883a0d6b861c4f11f91f2c57207aefd26
       linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest

From 0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:51:08 +0900
Subject: [PATCH 5/6] fix: trust exact workspace inside gate container

---
 .github/workflows/quality-gate.yml | 3 ++-
 tests/test_workflow_wiring.py      | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index 2fb3531..0c20e36 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -65,7 +65,8 @@ jobs:
             echo 'Unable to resolve gate comparison revisions.' >&2
             exit 1
           fi
-          git -c safe.directory="$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
       - name: Check out quality gate implementation
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index f49ace2..956ed90 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -38,10 +38,10 @@ def test_comparison_revisions_are_fetched_before_source_checkout(self) -> None:
 
         self.assertLess(fetch_index, source_checkout_index)
         self.assertIn(
-            'git -c safe.directory="$GITHUB_WORKSPACE" fetch --no-tags --depth=1 origin '
-            '"$BASE_SHA" "$HEAD_SHA"',
+            'git config --global --add safe.directory "$GITHUB_WORKSPACE"',
             source,
         )
+        self.assertIn('git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"', source)
 
     def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
         source = ORG_CALLER.read_text()

From 1c50cf31b068be0784c3adae4b7b96db42d04938 Mon Sep 17 00:00:00 2001
From: kazuki nakai <kazuki.nakai@agiletec.net>
Date: Fri, 24 Jul 2026 22:51:35 +0900
Subject: [PATCH 6/6] security: pin caller to container trust fix

---
 .github/workflows/org-quality-gate.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index eba0682..f4b00e7 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@c088ff9883a0d6b861c4f11f91f2c57207aefd26
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
     with:
-      source-ref: c088ff9883a0d6b861c4f11f91f2c57207aefd26
+      source-ref: 0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
       linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest