From b9213a03c0329d2ac64c8254dc69bfded4666bf8 Mon Sep 17 00:00:00 2001 From: Jarian Date: Sun, 5 Jul 2026 05:01:58 +0000 Subject: [PATCH] fix: CI clone must fetch PR SHA before checkout Shallow clone (--depth 1) only gets default branch HEAD. PR SHA checkout fails silently (|| true), so all jobs run against wrong commit. Now fetches PR SHA explicitly before checkout. Closes #45 --- .gitea/workflows/ci.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index abd8e25..6b0caae 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -19,7 +19,8 @@ jobs: run: | rm -rf $GITHUB_WORKSPACE/* git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE - git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true - name: Run ruff (Python lint) if: always() @@ -50,7 +51,8 @@ jobs: run: | rm -rf $GITHUB_WORKSPACE/* git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE - git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true - name: Run pytest (Python) if: always() @@ -90,7 +92,8 @@ jobs: run: | rm -rf $GITHUB_WORKSPACE/* git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE - git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true - name: Build Docker images if: always() @@ -121,7 +124,8 @@ jobs: run: | rm -rf $GITHUB_WORKSPACE/* git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE - git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE fetch --depth 1 origin $GITHUB_SHA 2>/dev/null || true + git -C $GITHUB_WORKSPACE checkout FETCH_HEAD 2>/dev/null || git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true - name: Run bandit (Python SAST) if: always()