Allow overriding the base ref used for comparison by mateuszkwiecinski · Pull Request #248 · usefulness/dependency-tree-diff-action

mateuszkwiecinski · 2026-08-07T11:58:10Z

Closes #247

Why

The comparison base was resolved from github.base_ref with no way to override it. With GitHub's stacked pull requests that produces false positives: the merge commit CI checks out is built on top of the parent PR's merge commit (which already contains recent main), while github.base_ref points at the stack base. Both sides of the comparison then hold a different version of main, and dependency changes that landed there get reported as introduced by the pull request.

What changed

New base-ref input, defaulting to '' so it falls back to github.base_ref — existing setups behave exactly as before:

INPUT_BASEREF: ${{ inputs.base-ref || github.base_ref }}

The base ref is now resolved as any commit-ish, not just a remote branch name:

if git fetch --force origin "$INPUT_BASEREF" --no-tags; then
  base_ref="FETCH_HEAD"
else
  echo "Could not fetch '$INPUT_BASEREF' from origin, resolving it in the local repository instead"
  base_ref="$INPUT_BASEREF"
fi
git switch --force --detach "$base_ref"

Fetch-first keeps the default path identical to today (always the freshest remote state, never a stale local branch); the fallback is what makes HEAD^1 and unpushed commits work. The :refspec destination had to go — a sha cannot be fetched into a branch of the same name — and --detach covers branch names and shas uniformly.

There is also an upfront guard for an empty base ref, which previously failed deep in the script with couldn't find remote ref from a ":" refspec.

The stacked-PR fix is then a one-liner, no resolve_base step needed:

- uses: actions/checkout@v4
  with:
    fetch-depth: 2   # merge commit + its parents

- uses: usefulness/dependency-tree-diff-action@v2
  with:
    base-ref: HEAD^1

Notes for the reviewer

The git logic was exercised locally against a fixture repo mimicking a PR merge ref in a shallow checkout: branch name, HEAD^1, and an explicit sha (with and without uploadpack.allowAnySHA1InWant) all land on the intended commit; an unresolvable ref exits 128 before any diffing happens.
entrypoint.ps1 is verified by inspection only — no pwsh on the machine this was written on. The try/catch around git fetch covers PowerShell 7.4's throw-on-native-error in addition to the $LASTEXITCODE check. The Windows CI job should confirm the unchanged default path.
New test-job-with-custom-base-ref job runs the action twice, once per resolution path (local-only HEAD^1, then github.event.pull_request.base.sha via origin). The version downgrade is re-applied between the two runs because git switch --force discards it — pre-existing behaviour, but without re-applying it the second assertion would be vacuous.

🤖 Generated with Claude Code

github-actions · 2026-08-07T11:58:51Z

Test2

 +--- org.jetbrains.kotlin:kotlin-stdlib:2.4.10
-|    \--- org.jetbrains:annotations:13.0 -> 23.0.0
+|    +--- org.jetbrains:annotations:13.0
+|    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0 (c)
+|    +--- org.jetbrains.kotlin:kotlin-stdlib-common:2.4.10 (c)
+|    \--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0 (c)
-\--- androidx.paging:paging-common-ktx:3.5.0
-     +--- androidx.paging:paging-common:3.5.0
-     |    \--- androidx.paging:paging-common-desktop:3.5.0
-     |         +--- androidx.annotation:annotation:1.9.1
-     |         |    \--- androidx.annotation:annotation-jvm:1.9.1
-     |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:1.9.24 -> 2.4.10 (*)
-     |         +--- androidx.arch.core:core-common:2.2.0
-     |         |    \--- androidx.annotation:annotation:1.1.0 -> 1.9.1 (*)
-     |         +--- org.jetbrains.kotlin:kotlin-stdlib:2.1.20 -> 2.4.10 (*)
-     |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0
-     |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.9.0
-     |         |         +--- org.jetbrains:annotations:23.0.0
-     |         |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.9.0
-     |         |         |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.9.0 (c)
-     |         |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0 (c)
-     |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:2.0.0 -> 2.4.10 (*)
-     |         \--- androidx.paging:paging-common-ktx:3.5.0 (c)
-     +--- org.jetbrains.kotlin:kotlin-stdlib:2.1.20 -> 2.4.10 (*)
-     \--- androidx.paging:paging-common:3.5.0 (c)
+\--- androidx.paging:paging-common-ktx:3.2.0
+     +--- androidx.paging:paging-common:3.2.0
+     |    +--- androidx.annotation:annotation:1.3.0
+     |    +--- androidx.arch.core:core-common:2.2.0
+     |    |    \--- androidx.annotation:annotation:1.1.0 -> 1.3.0
+     |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.8.21 -> 2.4.10 (*)
+     |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4
+     |    |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4
+     |    |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.6.4
+     |    |         |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4 (c)
+     |    |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4 (c)
+     |    |         +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.21 -> 1.8.0
+     |    |         |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.8.0 -> 2.4.10 (*)
+     |    |         |    \--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0
+     |    |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:1.8.0 -> 2.4.10 (*)
+     |    |         \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.6.21 -> 2.4.10
+     |    |              \--- org.jetbrains.kotlin:kotlin-stdlib:2.4.10 (*)
+     |    \--- androidx.paging:paging-common-ktx:3.2.0 (c)
+     \--- androidx.paging:paging-common:3.2.0 (c)

github-actions · 2026-08-07T11:58:55Z

Test1

 +--- org.jetbrains.kotlin:kotlin-stdlib:2.4.10
-|    \--- org.jetbrains:annotations:13.0 -> 23.0.0
+|    +--- org.jetbrains:annotations:13.0
+|    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0 (c)
+|    +--- org.jetbrains.kotlin:kotlin-stdlib-common:2.4.10 (c)
+|    \--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0 (c)
-\--- androidx.paging:paging-common-ktx:3.5.0
-     +--- androidx.paging:paging-common:3.5.0
-     |    \--- androidx.paging:paging-common-desktop:3.5.0
-     |         +--- androidx.annotation:annotation:1.9.1
-     |         |    \--- androidx.annotation:annotation-jvm:1.9.1
-     |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:1.9.24 -> 2.4.10 (*)
-     |         +--- androidx.arch.core:core-common:2.2.0
-     |         |    \--- androidx.annotation:annotation:1.1.0 -> 1.9.1 (*)
-     |         +--- org.jetbrains.kotlin:kotlin-stdlib:2.1.20 -> 2.4.10 (*)
-     |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0
-     |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.9.0
-     |         |         +--- org.jetbrains:annotations:23.0.0
-     |         |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.9.0
-     |         |         |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.9.0 (c)
-     |         |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0 (c)
-     |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:2.0.0 -> 2.4.10 (*)
-     |         \--- androidx.paging:paging-common-ktx:3.5.0 (c)
-     +--- org.jetbrains.kotlin:kotlin-stdlib:2.1.20 -> 2.4.10 (*)
-     \--- androidx.paging:paging-common:3.5.0 (c)
+\--- androidx.paging:paging-common-ktx:3.2.0
+     +--- androidx.paging:paging-common:3.2.0
+     |    +--- androidx.annotation:annotation:1.3.0
+     |    +--- androidx.arch.core:core-common:2.2.0
+     |    |    \--- androidx.annotation:annotation:1.1.0 -> 1.3.0
+     |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.8.21 -> 2.4.10 (*)
+     |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4
+     |    |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4
+     |    |         +--- org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.6.4
+     |    |         |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4 (c)
+     |    |         |    \--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4 (c)
+     |    |         +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.21 -> 1.8.0
+     |    |         |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.8.0 -> 2.4.10 (*)
+     |    |         |    \--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.0
+     |    |         |         \--- org.jetbrains.kotlin:kotlin-stdlib:1.8.0 -> 2.4.10 (*)
+     |    |         \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.6.21 -> 2.4.10
+     |    |              \--- org.jetbrains.kotlin:kotlin-stdlib:2.4.10 (*)
+     |    \--- androidx.paging:paging-common-ktx:3.2.0 (c)
+     \--- androidx.paging:paging-common:3.2.0 (c)

output path: /home/runner/work/dependency-tree-diff-action/dependency-tree-diff-action/testproject/dependency-tree-diff_output.txt
base dependencies: /home/runner/work/dependency-tree-diff-action/dependency-tree-diff-action/testproject/dependency-tree-diff_dependencies-base.txt
head dependencies: /home/runner/work/dependency-tree-diff-action/dependency-tree-diff-action/testproject/dependency-tree-diff_dependencies-head.txt

The action resolved the comparison base from `github.base_ref` with no way to override it. For GitHub's stacked pull requests that produces false positives: the merge commit CI checks out is built on top of the parent PR's merge commit (which already contains recent `main`), while `github.base_ref` points at the stack base. Both sides then hold a different version of `main`, and dependency changes that landed there get reported as introduced by the pull request. Add an optional `base-ref` input falling back to `github.base_ref`, so the default behaviour is unchanged, and resolve it as any commit-ish instead of a remote branch name only. The ref is still fetched from `origin` first, so branch names keep resolving to the freshest remote state; refs that only exist locally (`HEAD^1`, an unpushed commit) fall back to the local repository. Fetching a sha into a branch of the same name is not possible, hence the dropped refspec destination and the detached switch, which covers branch names and shas alike. Closes #247 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mateuszkwiecinski force-pushed the mateuszkwiecinski/dependency-tree-diff-247-b0a5d5 branch from a357ae0 to 29dedf8 Compare August 7, 2026 12:01

mateuszkwiecinski marked this pull request as ready for review August 7, 2026 12:03

mateuszkwiecinski merged commit a9b2aa1 into master Aug 7, 2026
6 checks passed

mateuszkwiecinski deleted the mateuszkwiecinski/dependency-tree-diff-247-b0a5d5 branch August 7, 2026 12:11

Navigation Menu

Uh oh!

Allow overriding the base ref used for comparison - #248

Allow overriding the base ref used for comparison#248
mateuszkwiecinski merged 1 commit into
masterfrom
mateuszkwiecinski/dependency-tree-diff-247-b0a5d5

mateuszkwiecinski commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

mateuszkwiecinski commented Aug 7, 2026

Why

What changed

Notes for the reviewer

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant