Repository navigation
Trusted PR configuration restoration turns a full checkout into a shallow one #1642
Description
Describe the bug
Running the action on a pull request converts an initially complete Git repository into a shallow repository.
The repository is checked out with:
fetch-depth: 0
Immediately after checkout, the following command returns false as expected:
$> git rev-parse --is-shallow-repository
false
and .git/shallow does not exist.
During claude-code-action, the trusted PR configuration restoration fetches the PR base branch:
Restoring .claude, .mcp.json, .claude.json, .gitmodules, .ripgreprc, CLAUDE.md, CLAUDE.local.md, .husky from origin/master (PR head is untrusted)
Preserved PR's sensitive paths -> .claude-pr/ for review agents (not executed)
From https://<host>/<owner>/<repository>
* branch master -> FETCH_HEAD
After this operation, the main repository has become shallow:
$> git rev-parse --is-shallow-repository
true
This can cause Git operations requiring ancestry traversal to fail. In our case, the review agent attempted to get the diff between a PR branch and the target base with:
git diff 4cdba231d58751ea4af09d80ca3673e4673f8694...c9819a942dbbe8553b45829ddecba02a7935ad70
and received:
fatal: 4cdba231d58751ea4af09d80ca3673e4673f8694...c9819a942dbbe8553b45829ddecba02a7935ad70: no merge base
To Reproduce
Check out a pull-request head with full history:
- uses: actions/checkout@v7
with:
ref: refs/pull/${{ env.PR_NUMBER }}/head
fetch-depth: 0
Check that the repository is complete:
- name: Check Git state before Claude
run: |
git rev-parse --is-shallow-repository
test ! -e .git/shallow
Expected output:
false
Run anthropics/claude-code-action@v1 for the pull request:
- uses: anthropics/claude-code-action@v1
with:
use_bedrock: true
github_token: ${{ steps.app-token.outputs.token }}
prompt: /review-pr <PR URL>
claude_args: |
--model <model>
--allowedTools "Bash(git diff:*),Bash(git log:*),Bash(git show:*)"
Observe the trusted configuration restoration in the action log:
Restoring .claude, .mcp.json, .claude.json, .gitmodules, .ripgreprc, CLAUDE.md, CLAUDE.local.md, .husky from origin/master (PR head is untrusted)
...
From https://<host>/<owner>/<repository>
* branch master -> FETCH_HEAD
Check the repository after the action:
- name: Check Git state after Claude
run: |
git rev-parse --is-shallow-repository
test ! -e .git/shallow
Observed result:
true
Expected behavior
The trusted PR configuration restoration should not change an initially complete repository into a shallow repository. Git operations such as these should continue to work:
git merge-base <base-sha> <head-sha>
git diff <base-sha>...<head-sha>
Screenshots
Not applicable. Relevant logs are included above.
Workflow yml file
Relevant parts of the workflow:
- uses: actions/checkout@v7
with:
ref: refs/pull/${{ env.PR_NUMBER }}/head
fetch-depth: 0
- uses: anthropics/claude-code-action@v1
with:
use_bedrock: true
github_token: ${{ steps.app-token.outputs.token }}
prompt: >-
/review-pr
${{ env.GH_HOST }}/${{ github.repository }}/pull/${{ env.PR_NUMBER }}
claude_args: |
--model <model>
--mcp-config "${{ env.MCP_CONFIG_PATH }}"
--allowedTools "Bash(git diff:*),Bash(git log:*),Bash(git show:*)"
The initial checkout log confirms that the main repository is fetched without --depth:
git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin \
+refs/heads/*:refs/remotes/origin/* \
+refs/tags/*:refs/tags/* \
+refs/pull/<PR>/head:refs/remotes/pull/<PR>/head
API Provider
[ ] Anthropic First-Party API (default)
[x] AWS Bedrock
[ ] GCP Vertex
Additional context
Environment:
Runner: self-hosted Linux
Runner version: 2.330.0
Git version: 2.43.0
Checkout: actions/checkout@v7
Claude action: anthropics/claude-code-action@v1
Resolved action SHA: 239e3a7
The workspace is on a persistent self-hosted runner, but actions/checkout deletes and reinitializes the main repository at the start of the job.
Activity
fix: only limit fetch depth when the checkout is already shallow (#1647)