Skip to content

Fix reviewer checkout after merged PR branch deletion #71210

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 3 commits into from
Oct 22, 2026
Merged

Fix reviewer checkout after merged PR branch deletion #71210

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6e673fd
Fix PR checkout after merged head branch deletion
pelikhan Oct 22, 2026
62038ed
Document retained PR head checkout in compiler threat spec
pelikhan Oct 22, 2026
c27cf8c
Address checkout review documentation and ref consistency
pelikhan Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 9 additions & 11 deletions actions/setup/js/checkout_pr_branch.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
* This script handles checkout for different GitHub event types:
*
* 1. pull_request: Runs in merge commit context (PR head + base merged)
* - Can use direct git commands since we're already in PR context
* - Branch exists in current checkout
* - Uses refs/pull/N/head even for same-repository PRs
* - The retained PR ref survives head branch deletion after merge
*
* 2. pull_request_target: Runs in BASE repository context (not PR head)
* - CRITICAL: For fork PRs, the head branch doesn't exist in base repo
Expand Down Expand Up @@ -467,24 +467,22 @@ async function main() {
const { isFork } = logPRContext(eventName, pullRequest);

if (eventName === "pull_request" && isFork === false && !isClosed) {
// For non-fork pull_request events, we run in the merge commit context.
// The PR branch is in the same repo as origin, so we can use direct git commands.
// Fork PRs cannot use git fetch because their head branch only exists in the fork
// (not in origin/base repo), so they must use gh pr checkout in the else branch below.
// Use the retained PR head ref, not the branch name: the PR may have
// merged and its branch disappeared since the webhook was captured.
const branchName = pullRequest.head.ref;
// commits is in the payload for pull_request events; +1 to include the merge base
const commitCount = pullRequest.commits || 1;
const fetchDepth = commitCount + 1;

logCheckoutStrategy(eventName, "git fetch + checkout", "pull_request event runs in merge commit context with PR branch available");
logCheckoutStrategy(eventName, "git fetch refs/pull + checkout", "same-repository pull_request event; retained PR head ref survives branch deletion");

core.info(`Fetching branch: ${branchName} from origin (depth: ${fetchDepth} for ${commitCount} PR commit(s))`);
core.info(`Fetching PR #${pullRequest.number} head via refs/pull/${pullRequest.number}/head (depth: ${fetchDepth} for ${commitCount} PR commit(s))`);
const fetchArgs = await depthArgs(fetchDepth);
core.info(fetchArgs.length > 0 ? `Fetching with ${fetchArgs.join(" ")}` : "Fetching without --depth (full history preserved)");
await fetchPRHead([branchName, ...fetchArgs]);
await fetchPRHead([`+refs/pull/${pullRequest.number}/head:${PR_HEAD_BASE_REF}`, ...fetchArgs]);

core.info(`Checking out branch: ${branchName}`);
await exec.exec("git", ["checkout", branchName]);
await exec.exec("git", ["checkout", "-B", branchName, PR_HEAD_BASE_REF]);

await exportPRHeadBaseline({
branchName,
Expand Down Expand Up @@ -533,7 +531,7 @@ async function main() {

const branchName = headRef || `pr-${prNumber}`;
core.info(`Checking out branch: ${branchName}`);
await exec.exec("git", ["checkout", "-B", branchName, "origin/pr-head"]);
await exec.exec("git", ["checkout", "-B", branchName, PR_HEAD_BASE_REF]);

await exportPRHeadBaseline({
branchName,
Expand Down
Loading
Loading