fix: never accept a partial or stale list of the pull request's commits

- A local range shorter than the payload's commit count is the history
  a shallow clone had room for, not the pull request: the API is asked
  first, and the local list is kept only when the API cannot answer, as
  before.
- An API list is used only when it ends at the payload's head commit. A
  force push after the event can leave the same count and other
  commits.
- The README names the two fallbacks separately: an unlisted pull
  request checks HEAD alone, an unfetched head skips the author checks.

Tests cover both, and the git-missing branch of the head fetch that
Codecov flagged. TestGetPrCommitMessages pins the event to {} so it
never reads the CI run it happens to execute in.

Author: shenxianpeng

README.md

@@ -63,8 +63,9 @@ jobs:
 > `fetch-depth: 0` is recommended, not required. A shallow clone holds only
 > GitHub's merge commit, so the action lists the pull request's commits
 > through the API — up to 250, with `pull-requests: read` — and fetches the
-> head commit for the author checks. If neither works it warns and checks
-> HEAD alone.
+> head commit for the author checks. If the commits cannot be listed, it warns
+> and checks HEAD alone; if the head commit cannot be fetched, it warns and
+> skips the author checks.
 
 Runs on `ubuntu-latest`, `macos-latest` and `windows-latest`. Self-hosted
 runners need a few tools — see [Good to know](#good-to-know).

main.py

@@ -500,7 +500,11 @@ def get_messages_from_api() -> list[Commit]:
         Github(auth=Auth.Token(token), base_url=api_url).get_repo(repo).get_pull(number)
     )
     commits = [(c.sha, c.commit.message) for c in pull.get_commits()]
-    return commits if len(commits) == total else []
+    # A force push after the event can leave the same count but other commits.
+    head = get_pr_head_sha()
+    if len(commits) != total or (head and commits[-1][0] != head):
+        return []
+    return commits
 
 
 def get_pr_commit_messages() -> list[Commit]:
@@ -511,27 +515,23 @@ def get_pr_commit_messages() -> list[Commit]:
     checkout HEAD is the synthetic merge commit, so ``HEAD^1..HEAD^2`` is
     the same range. If the workflow checks out the PR head SHA instead,
     diff against ``origin/<base-ref>`` when that ref is available locally.
-    A clone that holds none of these asks the API.
+    A clone that holds none of these, or only part of the pull request (a
+    shallow boundary ends a range early), asks the API.
     """
     if not is_pr_event():
         return []
 
     try:
-        messages = get_messages_from_event_range()
-        if messages:
-            return messages
-
-        messages = get_messages_from_merge_ref()
-        if messages:
-            return messages
-
         base_ref = os.getenv("GITHUB_BASE_REF", "")
-        if base_ref:
-            messages = get_messages_from_head_ref(base_ref)
-            if messages:
-                return messages
-
-        return get_messages_from_api()
+        messages = (
+            get_messages_from_event_range()
+            or get_messages_from_merge_ref()
+            or (get_messages_from_head_ref(base_ref) if base_ref else [])
+        )
+        total = get_pr_event().get("commits")
+        if messages and (not total or len(messages) == total):
+            return messages
+        return get_messages_from_api() or messages
     except Exception as e:
         print(
             f"::warning::Failed to retrieve PR commit messages: {e}",

main_test.py

@@ -458,6 +458,12 @@ def test_unknown_flag_is_skipped(self):
 
 
 class TestGetPrCommitMessages(unittest.TestCase):
+    def setUp(self):
+        # Never the event of whatever CI run the tests happen to be in.
+        patcher = patch("main.get_pr_event", return_value={})
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
     def test_non_pr_event_returns_empty(self):
         with patch.dict(os.environ, {"GITHUB_EVENT_NAME": "push"}):
             result = main.get_pr_commit_messages()
@@ -502,6 +508,17 @@ def test_pull_request_target_is_supported(self):
             result = main.get_pr_commit_messages()
         self.assertEqual(result, ["fix: first"])
 
+    def test_a_range_cut_short_by_a_shallow_clone_asks_the_api(self):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_messages_from_event_range", return_value=[("b2", "fix")]),
+            patch("main.get_pr_event", return_value={"commits": 2}),
+            patch("main.get_messages_from_api", return_value=[]) as api,
+        ):
+            # The API cannot help either: keep what the clone had.
+            self.assertEqual(main.get_pr_commit_messages(), [("b2", "fix")])
+        api.assert_called_once()
+
     def test_asks_the_api_when_the_clone_holds_none_of_them(self):
         with (
             patch.dict(
@@ -1060,11 +1077,15 @@ def test_a_head_the_clone_lacks_is_fetched_without_history(self):
             ["git", "fetch", "--no-tags", "--quiet", "--depth=1", "origin", "abc123"],
         )
 
+    def test_a_fetch_without_git_gives_up(self):
+        with patch("main.subprocess.run", side_effect=OSError("no git")):
+            self.assertFalse(main._fetch_commit("abc123"))
+
 
 class TestGetMessagesFromApi(unittest.TestCase):
     """A clone without the pull request's commits lists them through the API."""
 
-    def _run(self, total, api_commits):
+    def _run(self, total, api_commits, head="b2"):
         pull = MagicMock()
         pull.get_commits.return_value = [
             MagicMock(sha=sha, commit=MagicMock(message=msg))
@@ -1082,6 +1103,7 @@ def _run(self, total, api_commits):
         with (
             patch.dict(os.environ, env),
             patch("main.get_pr_event", return_value={"number": 7, "commits": total}),
+            patch("main.get_pr_head_sha", return_value=head),
             patch.dict(sys.modules, {"github": github_module}),
         ):
             return main.get_messages_from_api(), github_module
@@ -1095,6 +1117,11 @@ def test_lists_the_commits_oldest_first(self):
             "https://ghe.example.com/api/v3",
         )
 
+    def test_a_list_that_ends_elsewhere_is_not_used(self):
+        # A force push after the event: same count, other commits.
+        result, _ = self._run(2, [("a1", "feat: one"), ("c3", "fix: other")])
+        self.assertEqual(result, [])
+
     def test_a_partial_list_is_not_used(self):
         result, _ = self._run(3, [("a1", "feat: one"), ("b2", "fix: two")])
         self.assertEqual(result, [])