feat: check a pull request's commits without fetch-depth: 0 (#295)

Author: shenxianpeng

README.md

@@ -46,9 +46,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          # Required. With the default fetch-depth: 1 the clone holds only GitHub's
-          # merge commit: the PR's own commits cannot be listed, author checks are
-          # skipped, and the action warns and falls back to checking HEAD alone.
+          # Recommended: the action then reads the PR's commits from the clone.
+          # With the default fetch-depth: 1 it asks the GitHub API instead.
           fetch-depth: 0
       - uses: commit-check/commit-check-action@v2
         with:
@@ -60,11 +59,13 @@ jobs:
           pr-comments: true
 ```
 
-> [!IMPORTANT]
-> Keep `fetch-depth: 0`. A shallow clone holds only GitHub's merge commit,
-> whose `Merge <sha> into <sha>` subject passes the default rules, so every
-> pull request would look green; the action warns when it happens. On
-> `pull_request_target`, also check out `refs/pull/<number>/merge`.
+> [!NOTE]
+> `fetch-depth: 0` is recommended, not required. A shallow clone holds only
+> GitHub's merge commit, so the action lists the pull request's commits
+> through the API — up to 250, with `pull-requests: read` — and fetches the
+> head commit for the author checks. If the commits cannot be listed, it warns
+> and checks HEAD alone; if the head commit cannot be fetched, it warns and
+> skips the author checks.
 
 Runs on `ubuntu-latest`, `macos-latest` and `windows-latest`. Self-hosted
 runners need a few tools — see [Good to know](#good-to-know).
@@ -263,7 +264,7 @@ The action is a composite step and uses what the runner already has:
   dependencies are pinned by `requirements.txt` but not verified.
 - **Network access to PyPI and `api.github.com`** — the pinned wheels are
   downloaded once per run and the attestation is fetched from GitHub.
-- **`git`** on `PATH`, and a checkout with `fetch-depth: 0` (see above).
+- **`git`** on `PATH`.
 
 There is currently no input to skip attestation verification.
 

main.py

@@ -299,6 +299,21 @@ def _rev_resolves(rev: str) -> bool:
     return result.returncode == 0
 
 
+def _fetch_commit(sha: str) -> bool:
+    """Fetch one commit, without its history, into a clone that lacks it."""
+    try:
+        result = subprocess.run(
+            ["git", "fetch", "--no-tags", "--quiet", "--depth=1", "origin", sha],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            encoding="utf-8",
+            check=False,
+        )
+    except OSError:
+        return False
+    return result.returncode == 0 and _rev_resolves(sha)
+
+
 def pr_head_rev() -> str | None:
     """The commit whose recorded author the PR's author checks read.
 
@@ -308,12 +323,13 @@ def pr_head_rev() -> str | None:
     that, ``HEAD^2`` on a ``pull_request`` checkout, where HEAD is the
     merge ref and its second parent is that same tip. Never ``HEAD^2`` on
     ``pull_request_target``: there HEAD is the base branch, so ``HEAD^2``
-    is nothing, or the parent of some unrelated merge on it.
+    is nothing, or the parent of some unrelated merge on it. A shallow clone
+    that lacks the tip gets it fetched, without its history.
 
-    ``None`` when the clone is too shallow to hold either.
+    ``None`` when neither can be had.
     """
     sha = get_pr_head_sha()
-    if sha and _rev_resolves(sha):
+    if sha and (_rev_resolves(sha) or _fetch_commit(sha)):
         return sha
     if os.getenv("GITHUB_EVENT_NAME") == "pull_request" and _rev_resolves(PR_HEAD_REV):
         return PR_HEAD_REV
@@ -460,6 +476,37 @@ def get_messages_from_head_ref(base_ref: str) -> list[Commit]:
     return _messages_in_range(f"origin/{base_ref}..HEAD")
 
 
+#: The most commits GitHub's pull request commits endpoint returns.
+API_COMMIT_LIMIT = 250
+
+
+def get_messages_from_api() -> list[Commit]:
+    """The pull request's commits from the REST API, for a clone without them.
+
+    The default ``actions/checkout`` clone holds only GitHub's merge commit.
+    Deepening it cannot list a pull request that merged its base branch in;
+    the API lists any pull request exactly. It stops at 250 commits, so a
+    longer one is left unlisted rather than checked in part.
+    """
+    pr = get_pr_event()
+    number, total = pr.get("number"), pr.get("commits", 0)
+    token, repo = os.getenv("GITHUB_TOKEN"), os.getenv("GITHUB_REPOSITORY")
+    if not (number and token and repo) or total > API_COMMIT_LIMIT:
+        return []
+    from github import Auth, Github  # type: ignore
+
+    api_url = os.getenv("GITHUB_API_URL", "https://api.github.com")
+    pull = (
+        Github(auth=Auth.Token(token), base_url=api_url).get_repo(repo).get_pull(number)
+    )
+    commits = [(c.sha, c.commit.message) for c in pull.get_commits()]
+    # A force push after the event can leave the same count but other commits.
+    head = get_pr_head_sha()
+    if len(commits) != total or (head and commits[-1][0] != head):
+        return []
+    return commits
+
+
 def get_pr_commit_messages() -> list[Commit]:
     """Get all commits, as ``(sha, message)``, for the current PR workflow.
 
@@ -468,22 +515,32 @@ def get_pr_commit_messages() -> list[Commit]:
     checkout HEAD is the synthetic merge commit, so ``HEAD^1..HEAD^2`` is
     the same range. If the workflow checks out the PR head SHA instead,
     diff against ``origin/<base-ref>`` when that ref is available locally.
+    A clone that holds none of these, or only part of the pull request (a
+    shallow boundary ends a range early), asks the API.
     """
     if not is_pr_event():
         return []
 
     try:
-        messages = get_messages_from_event_range()
-        if messages:
+        base_ref = os.getenv("GITHUB_BASE_REF", "")
+        messages = (
+            get_messages_from_event_range()
+            or get_messages_from_merge_ref()
+            or (get_messages_from_head_ref(base_ref) if base_ref else [])
+        )
+        total = get_pr_event().get("commits")
+        if messages and (not total or len(messages) == total):
             return messages
-
-        messages = get_messages_from_merge_ref()
+        from_api = get_messages_from_api()
+        if from_api:
+            return from_api
         if messages:
-            return messages
-
-        base_ref = os.getenv("GITHUB_BASE_REF", "")
-        if base_ref:
-            return get_messages_from_head_ref(base_ref)
+            warn_shallow_checkout(
+                f"Only {len(messages)} of the pull request's {total} commits "
+                "could be listed",
+                "the others were not checked",
+            )
+        return messages
     except Exception as e:
         print(
             f"::warning::Failed to retrieve PR commit messages: {e}",

main_test.py

@@ -458,6 +458,12 @@ def test_unknown_flag_is_skipped(self):
 
 
 class TestGetPrCommitMessages(unittest.TestCase):
+    def setUp(self):
+        # Never the event of whatever CI run the tests happen to be in.
+        patcher = patch("main.get_pr_event", return_value={})
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
     def test_non_pr_event_returns_empty(self):
         with patch.dict(os.environ, {"GITHUB_EVENT_NAME": "push"}):
             result = main.get_pr_commit_messages()
@@ -502,6 +508,32 @@ def test_pull_request_target_is_supported(self):
             result = main.get_pr_commit_messages()
         self.assertEqual(result, ["fix: first"])
 
+    def test_a_range_cut_short_by_a_shallow_clone_asks_the_api(self):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_messages_from_event_range", return_value=[("b2", "fix")]),
+            patch("main.get_pr_event", return_value={"commits": 2}),
+            patch("main.get_messages_from_api", return_value=[]) as api,
+            patch("main.warn_shallow_checkout") as warn,
+        ):
+            # The API cannot help either: check what the clone had, and say so.
+            self.assertEqual(main.get_pr_commit_messages(), [("b2", "fix")])
+        api.assert_called_once()
+        self.assertIn("Only 1 of the pull request's 2 commits", warn.call_args[0][0])
+
+    def test_asks_the_api_when_the_clone_holds_none_of_them(self):
+        with (
+            patch.dict(
+                os.environ,
+                {"GITHUB_EVENT_NAME": "pull_request", "GITHUB_BASE_REF": "main"},
+            ),
+            patch("main.get_messages_from_event_range", return_value=[]),
+            patch("main.get_messages_from_merge_ref", return_value=[]),
+            patch("main.get_messages_from_head_ref", return_value=[]),
+            patch("main.get_messages_from_api", return_value=[("a1", "feat: one")]),
+        ):
+            self.assertEqual(main.get_pr_commit_messages(), [("a1", "feat: one")])
+
     def test_falls_back_to_base_ref_when_merge_ref_is_unavailable(self):
         with (
             patch.dict(
@@ -1027,6 +1059,81 @@ def test_missing_git_returns_none(self):
             self.assertIsNone(main.pr_head_rev())
 
 
+class TestFetchPrHead(unittest.TestCase):
+    def test_a_head_the_clone_lacks_is_fetched_without_history(self):
+        # rev-parse fails, the fetch succeeds, rev-parse now resolves.
+        run = MagicMock(
+            side_effect=[
+                MagicMock(returncode=1),
+                MagicMock(returncode=0),
+                MagicMock(returncode=0),
+            ]
+        )
+        with (
+            patch("main.get_pr_head_sha", return_value="abc123"),
+            patch("main.subprocess.run", run),
+        ):
+            self.assertEqual(main.pr_head_rev(), "abc123")
+        self.assertEqual(
+            run.call_args_list[1][0][0],
+            ["git", "fetch", "--no-tags", "--quiet", "--depth=1", "origin", "abc123"],
+        )
+
+    def test_a_fetch_without_git_gives_up(self):
+        with patch("main.subprocess.run", side_effect=OSError("no git")):
+            self.assertFalse(main._fetch_commit("abc123"))
+
+
+class TestGetMessagesFromApi(unittest.TestCase):
+    """A clone without the pull request's commits lists them through the API."""
+
+    def _run(self, total, api_commits, head="b2"):
+        pull = MagicMock()
+        pull.get_commits.return_value = [
+            MagicMock(sha=sha, commit=MagicMock(message=msg))
+            for sha, msg in api_commits
+        ]
+        github_module = MagicMock()
+        github_module.Github.return_value.get_repo.return_value.get_pull.return_value = (
+            pull
+        )
+        env = {
+            "GITHUB_TOKEN": "token",
+            "GITHUB_REPOSITORY": "owner/repo",
+            "GITHUB_API_URL": "https://ghe.example.com/api/v3",
+        }
+        with (
+            patch.dict(os.environ, env),
+            patch("main.get_pr_event", return_value={"number": 7, "commits": total}),
+            patch("main.get_pr_head_sha", return_value=head),
+            patch.dict(sys.modules, {"github": github_module}),
+        ):
+            return main.get_messages_from_api(), github_module
+
+    def test_lists_the_commits_oldest_first(self):
+        commits = [("a1", "feat: one"), ("b2", "fix: two")]
+        result, github_module = self._run(2, commits)
+        self.assertEqual(result, commits)
+        self.assertEqual(
+            github_module.Github.call_args[1]["base_url"],
+            "https://ghe.example.com/api/v3",
+        )
+
+    def test_a_list_that_ends_elsewhere_is_not_used(self):
+        # A force push after the event: same count, other commits.
+        result, _ = self._run(2, [("a1", "feat: one"), ("c3", "fix: other")])
+        self.assertEqual(result, [])
+
+    def test_a_partial_list_is_not_used(self):
+        result, _ = self._run(3, [("a1", "feat: one"), ("b2", "fix: two")])
+        self.assertEqual(result, [])
+
+    def test_more_than_the_api_returns_is_left_unlisted(self):
+        result, github_module = self._run(main.API_COMMIT_LIMIT + 1, [])
+        self.assertEqual(result, [])
+        github_module.Github.assert_not_called()
+
+
 class TestCheckoutHint(unittest.TestCase):
     def test_pull_request_names_fetch_depth(self):
         with patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}):