Skip to content

Only limit fetch depth when the checkout is already shallow - #1647

Merged
ashwin-ant merged 1 commit into
anthropics:mainfrom
winklemad:fix/fetch-depth-preserve-full-history
Aug 14, 2026
Merged

ashwin-ant merged 1 commit into
anthropics:mainfrom
winklemad:fix/fetch-depth-preserve-full-history

Conversation

@winklemad

Copy link
Copy Markdown
Contributor

Fixes #1642

Problem

restoreConfigFromBase fetches the PR base with --depth=1 on every PR-triggered run, and setupBranch passes --depth to each of its fetches. --depth doesn't only cap what gets downloaded: run against a checkout made with fetch-depth: 0 it also truncates the history that is already there and writes .git/shallow, so the merge base with the base branch disappears.

The damage only shows up on the realistic topology, where base has advanced since the PR branched (if the PR was cut from the current base tip there is nothing to truncate — which is why this is easy to miss locally). Reproduced with the action's exact command:

before after git fetch origin main --depth=1 --no-recurse-submodules
git rev-parse --is-shallow-repository false true
git merge-base origin/main HEAD resolves empty
git log origin/main..HEAD the PR's commit the PR's commit plus commits already merged into base
git diff origin/main...HEAD the PR's diff fatal: origin/main...HEAD: no merge base

Those two are exactly the commands the prompt tells Claude to run to scope its work to the PR (src/create-prompt/index.ts, and the git diff form is in the allowlist), so the action breaks its own documented workflow: silently wrong output from git log, hard failure from git diff, on every PR-triggered run in a repo that checks out with fetch-depth: 0.

Fix

Gate the flag on git rev-parse --is-shallow-repository in a small shared helper (src/github/operations/fetch-depth.ts), and use it at every --depth fetch in the action, not just the one from the issue:

  • restore-config.ts — the base branch fetch
  • branch.ts — the PR branch fetch, the fork refs/pull/N/head fetch, and both source-branch fetches (commit-signing and non-signing)

The trade-off, since the shallow fetch was deliberate (#53, for #52): on a checkout that is already shallow — the fetch-depth: 1 default, which is the case the speed-up was for — the arguments are unchanged and the saving is kept. Only a checkout that already has full history now fetches without a depth limit, which is what asking for fetch-depth: 0 means. If git rev-parse can't answer (not a repo, or a git too old for the flag) the helper assumes full history: over-fetching is recoverable, truncating history isn't.

Tests

  • test/restore-config.test.ts — regression test on the diverged topology (base advances after the PR branch is cut): asserts the repo is still not shallow after restoreConfigFromBase, the merge base still resolves to the same commit, origin/main..HEAD is still just the PR's commit, and the three-dot diff still works. Fails on main.
  • test/fetch-depth.test.ts — setupBranch keeps the full history of a complete checkout for both use_commit_signing values (also fails on main), plus coverage that an already shallow checkout still gets --depth and a complete one doesn't.

bun test 915 pass / 0 fail (910 before this change), bun run typecheck and bun run format:check clean.

restoreConfigFromBase and setupBranch pass --depth to every git fetch. On a
checkout made with fetch-depth: 0 that does not just cap the download: it
truncates the history already present and marks the repository shallow, which
drops the merge base with the base branch. `git log origin/<base>..HEAD` then
silently includes commits that are already merged, and
`git diff origin/<base>...HEAD` fails with "no merge base" — the two commands
the prompt tells Claude to run to scope its work to the PR.

Gate the flag on `git rev-parse --is-shallow-repository`, so a checkout that is
already shallow (the fetch-depth: 1 default) keeps the same depth behaviour and
the fetch savings it was added for, while a full checkout stays full.

Fixes anthropics#1642
@ashwin-ant
ashwin-ant merged commit ed186be into anthropics:main Aug 14, 2026
4 of 36 checks passed
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Aug 23, 2026
Bumps the github-actions group with 2 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).
Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
Release notes

*Sourced from [docker/setup-buildx-action's releases](https://github.com/docker/setup-buildx-action/releases).*

> v4.3.0
> ------
>
> * Bump `@​docker/actions-toolkit` from 0.92.0 to 0.95.0 in [docker/setup-buildx-action#595](https://redirect.github.com/docker/setup-buildx-action/pull/595)
> * Bump brace-expansion from 1.1.13 to 1.1.18 in [docker/setup-buildx-action#600](https://redirect.github.com/docker/setup-buildx-action/pull/600)
> * Bump js-yaml from 5.2.0 to 5.3.0 in [docker/setup-buildx-action#585](https://redirect.github.com/docker/setup-buildx-action/pull/585)
> * Bump postcss from 8.5.10 to 8.5.25 in [docker/setup-buildx-action#598](https://redirect.github.com/docker/setup-buildx-action/pull/598)
> * Bump undici from 6.27.0 to 6.28.0 in [docker/setup-buildx-action#601](https://redirect.github.com/docker/setup-buildx-action/pull/601)
>
> **Full Changelog**: <docker/setup-buildx-action@v4.2.0...v4.3.0>


Commits

* [`37fe631`](docker/setup-buildx-action@37fe631) Merge pull request [#595](https://redirect.github.com/docker/setup-buildx-action/issues/595) from docker/dependabot/npm\_and\_yarn/docker/actions-to...
* [`b5c4f91`](docker/setup-buildx-action@b5c4f91) [dependabot skip] chore: update generated content
* [`3e93b63`](docker/setup-buildx-action@3e93b63) build(deps): bump `@​docker/actions-toolkit` from 0.92.0 to 0.95.0
* [`e527031`](docker/setup-buildx-action@e527031) Merge pull request [#600](https://redirect.github.com/docker/setup-buildx-action/issues/600) from docker/dependabot/npm\_and\_yarn/brace-expansion-1...
* [`c68814b`](docker/setup-buildx-action@c68814b) [dependabot skip] chore: update generated content
* [`3f891b0`](docker/setup-buildx-action@3f891b0) build(deps): bump brace-expansion from 1.1.13 to 1.1.18
* [`787db26`](docker/setup-buildx-action@787db26) Merge pull request [#585](https://redirect.github.com/docker/setup-buildx-action/issues/585) from docker/dependabot/npm\_and\_yarn/js-yaml-5.2.1
* [`f779368`](docker/setup-buildx-action@f779368) [dependabot skip] chore: update generated content
* [`7d5e604`](docker/setup-buildx-action@7d5e604) build(deps): bump js-yaml from 5.2.0 to 5.3.0
* [`292c2fb`](docker/setup-buildx-action@292c2fb) Merge pull request [#590](https://redirect.github.com/docker/setup-buildx-action/issues/590) from docker/dependabot/github\_actions/actions/setup-n...
* Additional commits viewable in [compare view](docker/setup-buildx-action@bb05f3f...37fe631)
  
Updates `anthropics/claude-code-action` from 1.0.192 to 1.0.198
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.198
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.197...v1.0.198>
>
> v1.0.197
> --------
>
> What's Changed
> --------------
>
> * fix: neutralize the checkout credential under actions/checkout v6+ include layout ([#1510](https://redirect.github.com/anthropics/claude-code-action/issues/1510)) by [`@​TemRevil`](https://github.com/TemRevil) in [anthropics/claude-code-action#1526](https://redirect.github.com/anthropics/claude-code-action/pull/1526)
>
> New Contributors
> ----------------
>
> * [`@​TemRevil`](https://github.com/TemRevil) made their first contribution in [anthropics/claude-code-action#1526](https://redirect.github.com/anthropics/claude-code-action/pull/1526)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.196...v1.0.197>
>
> v1.0.196
> --------
>
> What's Changed
> --------------
>
> * fix(security): unify secret redaction in public comment outputs by [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) in [anthropics/claude-code-action#1693](https://redirect.github.com/anthropics/claude-code-action/pull/1693)
> * fix: strip unused ALL\_INPUTS environment variable from Claude subprocess env by [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) in [anthropics/claude-code-action#1692](https://redirect.github.com/anthropics/claude-code-action/pull/1692)
> * fix(github): match bot actors in comment filters using GraphQL \_\_typename by [`@​Neal006`](https://github.com/Neal006) in [anthropics/claude-code-action#1616](https://redirect.github.com/anthropics/claude-code-action/pull/1616)
>
> New Contributors
> ----------------
>
> * [`@​Juwan-Hwang`](https://github.com/Juwan-Hwang) made their first contribution in [anthropics/claude-code-action#1693](https://redirect.github.com/anthropics/claude-code-action/pull/1693)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.195...v1.0.196>
>
> v1.0.195
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.194...v1.0.195>
>
> v1.0.194
> --------
>
> What's Changed
> --------------
>
> * Harden delete\_files MCP tool: validate paths within repo root (consistency with commit\_files) by [`@​GabrielOnRails`](https://github.com/GabrielOnRails) in [anthropics/claude-code-action#1636](https://redirect.github.com/anthropics/claude-code-action/pull/1636)
> * Only limit fetch depth when the checkout is already shallow by [`@​winklemad`](https://github.com/winklemad) in [anthropics/claude-code-action#1647](https://redirect.github.com/anthropics/claude-code-action/pull/1647)
> * fix(base-action): add ~/.local/bin to $GITHUB\_PATH after auto-install by [`@​anishesg`](https://github.com/anishesg) in [anthropics/claude-code-action#1643](https://redirect.github.com/anthropics/claude-code-action/pull/1643)
> * feat(context): include diffHunk in PR review comment context by [`@​rishavnaskar`](https://github.com/rishavnaskar) in [anthropics/claude-code-action#1584](https://redirect.github.com/anthropics/claude-code-action/pull/1584)
> * ci: skip Claude-backed test jobs on fork PRs by [`@​ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1655](https://redirect.github.com/anthropics/claude-code-action/pull/1655)
> * fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by [`@​doshidhaval`](https://github.com/doshidhaval) in [anthropics/claude-code-action#1557](https://redirect.github.com/anthropics/claude-code-action/pull/1557)
> * fix(images): bound attachment downloads by [`@​abhinavkr26104`](https://github.com/abhinavkr26104) in [anthropics/claude-code-action#1625](https://redirect.github.com/anthropics/claude-code-action/pull/1625)
>
> New Contributors
> ----------------
>
> * [`@​GabrielOnRails`](https://github.com/GabrielOnRails) made their first contribution in [anthropics/claude-code-action#1636](https://redirect.github.com/anthropics/claude-code-action/pull/1636)
> * [`@​winklemad`](https://github.com/winklemad) made their first contribution in [anthropics/claude-code-action#1647](https://redirect.github.com/anthropics/claude-code-action/pull/1647)
> * [`@​doshidhaval`](https://github.com/doshidhaval) made their first contribution in [anthropics/claude-code-action#1557](https://redirect.github.com/anthropics/claude-code-action/pull/1557)
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.193...v1.0.194>
>
> v1.0.193
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1.0.192...v1.0.193>


Commits

* [`3f854a8`](anthropics/claude-code-action@3f854a8) chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238
* [`5ee796a`](anthropics/claude-code-action@5ee796a) chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237
* [`cff8d3c`](anthropics/claude-code-action@cff8d3c) fix(git-config): neutralize checkout credential in include-based config ([#1526](https://redirect.github.com/anthropics/claude-code-action/issues/1526))
* [`e2a4b76`](anthropics/claude-code-action@e2a4b76) chore: bump Claude Code to 2.1.236 and Agent SDK to 0.3.236
* [`65b50df`](anthropics/claude-code-action@65b50df) fix(github): match bot actors in comment filters using GraphQL \_\_typename ([#1](https://redirect.github.com/anthropics/claude-code-action/issues/1)...
* [`0a80d21`](anthropics/claude-code-action@0a80d21) fix: strip unused ALL\_INPUTS environment variable from Claude subprocess env ...
* [`54eadc2`](anthropics/claude-code-action@54eadc2) fix(security): unify secret redaction in public comment outputs ([#1693](https://redirect.github.com/anthropics/claude-code-action/issues/1693))
* [`d40ddef`](anthropics/claude-code-action@d40ddef) chore: bump Claude Code to 2.1.235 and Agent SDK to 0.3.235
* [`459ad35`](anthropics/claude-code-action@459ad35) chore: bump Claude Code to 2.1.234 and Agent SDK to 0.3.234
* [`d721746`](anthropics/claude-code-action@d721746) fix: bound image attachment downloads ([#1625](https://redirect.github.com/anthropics/claude-code-action/issues/1625))
* Additional commits viewable in [compare view](anthropics/claude-code-action@e63208c...3f854a8)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trusted PR configuration restoration turns a full checkout into a shallow one

2 participants