From 1e4fe8c7a22d0b135a1786c9e0cb9d82b2ad404a Mon Sep 17 00:00:00 2001
From: thedancingdeveloper
 <306930456+thedancingdeveloper@users.noreply.github.com>
Date: Mon, 24 Aug 2026 01:54:36 +0000
Subject: [PATCH] ci: fix migration-policy false positives from shallow base
 fetch

The policy.yml checkout already fetches full history, but this script then re-fetched the base ref with --depth=1. A shallow base ref grafts away its ancestry, so origin/BASE..HEAD stopped excluding the base tip's ancestors; on a PR branch that merged the base in (Update branch) historical base commits reappeared in the range and tripped the commit-metadata rule. Fetch the base full-depth and scope the scan to merge-base(BASE,HEAD)..HEAD. No change to what the policy forbids.
---
 ci/migration-policy.sh | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/ci/migration-policy.sh b/ci/migration-policy.sh
index b303ffb..e269fd2 100755
--- a/ci/migration-policy.sh
+++ b/ci/migration-policy.sh
@@ -19,8 +19,17 @@ if [[ -n "$workflow_matches" ]]; then
   fail 'workflow selects a hosted or unresolved dynamic runner'
 fi
 if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
-  git fetch --no-tags --depth=1 origin "$GITHUB_BASE_REF" >/dev/null 2>&1 || true
-  commits="$(git rev-list --reverse "origin/$GITHUB_BASE_REF..HEAD" 2>/dev/null || git rev-list --reverse HEAD~1..HEAD 2>/dev/null || git rev-list --reverse HEAD)"
+  # Fetch the base ref with full history (not --depth=1): a shallow base ref
+  # grafts away its ancestry, so `origin/BASE..HEAD` can no longer tell that
+  # the base tip's ancestors are shared with HEAD. On a branch that has merged
+  # the base in (e.g. after "Update branch"), that made historical base commits
+  # reappear in the range as false positives.
+  git fetch --no-tags origin "$GITHUB_BASE_REF" >/dev/null 2>&1 || true
+  # Scope to commits this PR actually introduces: everything since the branch
+  # diverged from the base (merge-base), which excludes commits merged in from
+  # the base itself.
+  base="$(git merge-base "origin/$GITHUB_BASE_REF" HEAD 2>/dev/null || true)"
+  commits="$(git rev-list --reverse "${base:+$base..}HEAD" 2>/dev/null || git rev-list --reverse HEAD~1..HEAD 2>/dev/null || git rev-list --reverse HEAD)"
 elif [[ "${GITHUB_EVENT_NAME:-}" == push && "${GITHUB_BEFORE:-}" != 0000000000000000000000000000000000000000 ]]; then
   commits="$(git rev-list --reverse "${GITHUB_BEFORE:-}..HEAD" 2>/dev/null || git rev-list --reverse HEAD~1..HEAD 2>/dev/null || git rev-list --reverse HEAD)"
 else