From e7004e550c4d4b0c7ed2a36add928a1c07de9a9d Mon Sep 17 00:00:00 2001
From: Jake Fineman <jakefineman@gmail.com>
Date: Thu, 6 Aug 2026 10:48:41 -0400
Subject: [PATCH] fix(ci): enforce gate scanned a partial range and could pass
 having read nothing

BASE=HEAD~1 scans one commit of a multi-commit push and reports the rest as
passing; when HEAD~1 does not resolve it degrades to BASE=HEAD, an empty diff
and a green job. Resolve to the empty-tree object so the full tree is scanned,
and add merge_group so the gate runs in the merge queue. Refs #1747.
---
 .github/workflows/governance-enforce.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance-enforce.yml b/.github/workflows/governance-enforce.yml
index e68aef6b..b8c2d70d 100644
--- a/.github/workflows/governance-enforce.yml
+++ b/.github/workflows/governance-enforce.yml
@@ -7,6 +7,7 @@ name: governance-enforce
 
 on:
   pull_request:
+  merge_group:
   push:
     branches: [main, master]
 
@@ -39,11 +40,17 @@ jobs:
       - name: A_BLOCK enforce (secrets + hardcoded paths on the diff)
         env:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          MERGE_BASE_SHA: ${{ github.event.merge_group.base_sha }}
           PUSH_BEFORE_SHA: ${{ github.event.before }}
         run: |
-          BASE="${PR_BASE_SHA:-$PUSH_BEFORE_SHA}"
+          BASE="${PR_BASE_SHA:-${MERGE_BASE_SHA:-$PUSH_BEFORE_SHA}}"
           if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
-            BASE=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
+            # Indeterminate base (first push / force-push). Do NOT silently scan a partial range —
+            # HEAD~1 would skip earlier commits in a multi-commit push and let a violation through
+            # (a config-no-silent-noop hole). Diff the full tree against git's empty-tree object so
+            # every introduced file is scanned; loud, never a silent empty/partial pass.
+            BASE=$(git hash-object -t tree /dev/null)
+            echo "::warning::indeterminate diff base; scanning full tree (empty-tree base) so no commit is skipped"
           fi
           echo "diffing against $BASE"
           node "$RUNNER_TEMP/gov/node_modules/@wave-av/governance/bin/enforce.mjs" --changed "$BASE"