From 306b4d3d2c22d7a2861b10162fb11ecb66ae0eb0 Mon Sep 17 00:00:00 2001
From: Joshua Temple <joshua.temple@stablekernel.com>
Date: Mon, 6 Jul 2026 03:56:17 -0400
Subject: [PATCH] fix(ci): pass changed files to the self-heal reconcile check
 and companion

Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
---
 .github/workflows/pin-reconcile.yaml | 16 +++++++++++++++-
 .github/workflows/pr.yaml            | 23 ++++++++++++++++++++++-
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pin-reconcile.yaml b/.github/workflows/pin-reconcile.yaml
index 2ababa98..40d14f86 100644
--- a/.github/workflows/pin-reconcile.yaml
+++ b/.github/workflows/pin-reconcile.yaml
@@ -122,6 +122,7 @@ jobs:
             core.setOutput('proceed', 'true');
             core.setOutput('head_ref', head.ref);
             core.setOutput('head_sha', head.sha);
+            core.setOutput('base_sha', base.sha);
 
       - name: Install released cascade CLI
         if: steps.resolve.outputs.proceed == 'true'
@@ -161,13 +162,26 @@ jobs:
 
       - name: Reconcile the pin manifest and regenerate
         if: steps.resolve.outputs.proceed == 'true'
+        env:
+          BASE_SHA: ${{ steps.resolve.outputs.base_sha }}
+          HEAD_SHA: ${{ steps.resolve.outputs.head_sha }}
         run: |
           set -euo pipefail
           git config user.name "cascade-bot"
           git config user.email "cascade-bot@users.noreply.github.com"
+          # List the changed governed source files a pin bump would land in.
+          # cascade's own governed sources are the hand-written workflows AND
+          # the composite actions, so diff over both. The SHAs come from trusted
+          # workflow_run metadata but are still routed through env and quoted.
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" \
+            -- .github/workflows/ .github/actions/ > changed-files.txt
+          args=()
+          while IFS= read -r f; do
+            [ -n "$f" ] && args+=(--changed-file "$f")
+          done < changed-files.txt
           # Own-repo mode writes the adopted ref into internal/generate/action_pins.yaml
           # and regenerates every generated workflow so they agree again.
-          cascade reconcile --own-repo
+          cascade reconcile --own-repo "${args[@]}"
 
       - name: Commit and push the reconciled pins
         if: steps.resolve.outputs.proceed == 'true'
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 8093b70e..adc86c5e 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -108,6 +108,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Full history so the reconcile detector can diff base..head to find
+          # the changed governed source files a pin bump would land in.
+          fetch-depth: 0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -135,6 +139,19 @@ jobs:
             drift-exit.txt
           retention-days: 1
 
+      # List the PR's changed governed source files so the reconcile detector
+      # scans them for a moved pin. cascade's own governed sources are the
+      # hand-written workflows AND the composite actions, so diff over both.
+      # The pull_request SHAs are attacker-influenceable on a fork PR, so they
+      # are routed through env and referenced as quoted shell variables.
+      - name: List changed governed source files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" \
+            -- .github/workflows/ .github/actions/ > changed-files.txt
+
       # Read-only reconcile detector. It records whether a governed action pin
       # moved in a source file so the pin-reconcile companion (workflow_run,
       # base-repo context) can adopt it back into the manifest. This step is
@@ -143,7 +160,11 @@ jobs:
       - name: Detect governed pin drift for reconcile
         run: |
           set +e
-          /tmp/cascade reconcile --check
+          args=()
+          while IFS= read -r f; do
+            [ -n "$f" ] && args+=(--changed-file "$f")
+          done < changed-files.txt
+          /tmp/cascade reconcile --check --check-output pin-reconcile-result.json "${args[@]}"
           echo "reconcile check exit: $?"
           set -e