Benjamin_Boenisch/breakpilot-compliance
1
1
Fork 0
Code Issues 24 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): clone PR head branch, not the unbuildable merge-ref
CI / detect-changes (pull_request) Successful in 6s
Details
CI / branch-name (pull_request) Successful in 1s
Details
CI / guardrail-integrity (pull_request) Successful in 11s
Details
CI / secret-scan (pull_request) Failing after 6s
Details
CI / dep-audit (pull_request) Failing after 56s
Details
CI / sbom-scan (pull_request) Failing after 1m9s
Details
CI / build-sha-integrity (pull_request) Successful in 14s
Details
CI / validate-canonical-controls (pull_request) Successful in 8s
Details
CI / loc-budget (pull_request) Successful in 18s
Details
CI / go-lint (pull_request) Failing after 26s
Details
CI / python-lint (pull_request) Failing after 13s
Details
CI / nodejs-lint (pull_request) Failing after 1m15s
Details
CI / nodejs-build (pull_request) Successful in 3m9s
Details
CI / test-go (pull_request) Successful in 1m7s
Details
CI / iace-gt-coverage (pull_request) Successful in 22s
Details
CI / test-python-backend (pull_request) Successful in 30s
Details
CI / test-python-document-crawler (pull_request) Successful in 18s
Details
CI / test-python-dsms-gateway (pull_request) Successful in 12s
Details

Browse Source 
All 17 checkout blocks cloned via --branch GITHUB_REF_NAME; on pull_request that is a merge ref git clone --branch cannot resolve, so every checkout-based gate (detect-changes, guardrail-integrity, secret-scan, sbom-scan, dep-audit, build-sha-integrity, validate-canonical-controls) failed before running. Now clone GITHUB_HEAD_REF with GITHUB_REF_NAME fallback: PR uses its source branch, push keeps prior behaviour. Additive.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
2026-06-21 14:16:29 +02:00
parent 24bb449a79
commit 079bb56922
1 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+17 -17
View File
@@ -43,7 +43,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git bash apk add --no-cache git bash
git clone --depth 200 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 200 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
git fetch --depth 200 origin "${GITHUB_BASE_REF}" || true git fetch --depth 200 origin "${GITHUB_BASE_REF}" || true
else else
@@ -87,7 +87,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git bash apk add --no-cache git bash
git clone --depth 20 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 20 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
git fetch origin ${GITHUB_BASE_REF}:base git fetch origin ${GITHUB_BASE_REF}:base
- name: Require [guardrail-change] in commits touching guardrails - name: Require [guardrail-change] in commits touching guardrails
run: | run: |
@@ -108,7 +108,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git bash apk add --no-cache git bash
git clone --depth 50 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 50 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Enforce 500-line hard cap - name: Enforce 500-line hard cap
run: | run: |
chmod +x scripts/check-loc.sh chmod +x scripts/check-loc.sh
@@ -123,7 +123,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git apk add --no-cache git
git clone --depth 50 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 50 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Scan for secrets - name: Scan for secrets
run: | run: |
gitleaks detect --source . --no-git \ gitleaks detect --source . --no-git \
@@ -141,7 +141,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git apk add --no-cache git
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Lint ai-compliance-sdk - name: Lint ai-compliance-sdk
run: | run: |
[ -d "ai-compliance-sdk" ] || exit 0 [ -d "ai-compliance-sdk" ] || exit 0
@@ -162,7 +162,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Lint (ruff) + type-check (mypy) - name: Lint (ruff) + type-check (mypy)
run: | run: |
pip install --quiet ruff mypy pip install --quiet ruff mypy
@@ -193,7 +193,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git apk add --no-cache git
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Lint + type-check - name: Lint + type-check
run: | run: |
fail=0 fail=0
@@ -215,7 +215,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git apk add --no-cache git
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Build Next.js services - name: Build Next.js services
run: | run: |
fail=0 fail=0
@@ -239,7 +239,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Install Node.js + Go - name: Install Node.js + Go
run: | run: |
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1 curl -fsSL https://deb.nodesource.com/setup_20.x | bash - > /dev/null 2>&1
@@ -282,7 +282,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git curl bash apk add --no-cache git curl bash
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Install syft + grype - name: Install syft + grype
run: | run: |
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
@@ -304,7 +304,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git apk add --no-cache git
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Test ai-compliance-sdk - name: Test ai-compliance-sdk
run: | run: |
[ -d "ai-compliance-sdk" ] || exit 0 [ -d "ai-compliance-sdk" ] || exit 0
@@ -324,7 +324,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: GT-Bremse measure-coverage report - name: GT-Bremse measure-coverage report
run: | run: |
python3 scripts/gt_measure_gap_analysis.py --json /tmp/gt_gap_report.json > /tmp/gt_gap_report.md python3 scripts/gt_measure_gap_analysis.py --json /tmp/gt_gap_report.json > /tmp/gt_gap_report.md
@@ -355,7 +355,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Test backend-compliance - name: Test backend-compliance
run: | run: |
[ -d "backend-compliance" ] || exit 0 [ -d "backend-compliance" ] || exit 0
@@ -375,7 +375,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Test document-crawler - name: Test document-crawler
run: | run: |
[ -d "document-crawler" ] || exit 0 [ -d "document-crawler" ] || exit 0
@@ -395,7 +395,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Test dsms-gateway - name: Test dsms-gateway
run: | run: |
[ -d "dsms-gateway" ] || exit 0 [ -d "dsms-gateway" ] || exit 0
@@ -417,7 +417,7 @@ jobs:
- name: Checkout - name: Checkout
run: | run: |
apk add --no-cache git python3 py3-yaml apk add --no-cache git python3 py3-yaml
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Validate every Dockerfile + compose block declares BUILD_SHA - name: Validate every Dockerfile + compose block declares BUILD_SHA
run: | run: |
python3 - <<'PY' python3 - <<'PY'
@@ -456,6 +456,6 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
run: | run: |
git clone --depth 1 --branch ${GITHUB_REF_NAME} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git . git clone --depth 1 --branch ${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git .
- name: Validate controls - name: Validate controls
run: python scripts/validate-controls.py run: python scripts/validate-controls.py