ci: bound history fetches for path checks and server test shards

.github/workflows/apps-web-check.yml

@@ -24,9 +24,13 @@ jobs:
       run:
         working-directory: apps/web
     steps:
+      # The change detector compares two snapshots, so only the tested commit
+      # is checked out and the compared commit is fetched below. Fetching every
+      # branch and tag in full exhausted this job's budget before any check
+      # ran (#8559).
       - uses: actions/checkout@v7.0.1
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           filter: blob:none
           sparse-checkout: |
             apps/web
@@ -39,20 +43,50 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           BASE_REF_NAME: ${{ github.base_ref }}
           BEFORE_SHA: ${{ github.event.before }}
+          # actions/checkout retries its fetches; this one replaces part of it.
+          FETCH_ATTEMPTS: "3"
+          FETCH_RETRY_DELAY_SECONDS: "5"
         run: |
           set -euo pipefail
           if [ "${EVENT_NAME}" = "pull_request" ]; then
-            compare_ref="origin/${BASE_REF_NAME}"
+            compare_ref="refs/remotes/origin/${BASE_REF_NAME}"
+            fetch_refspec="+refs/heads/${BASE_REF_NAME}:${compare_ref}"
           elif [ -n "${BEFORE_SHA}" ] && [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ]; then
             compare_ref="${BEFORE_SHA}"
+            fetch_refspec="${BEFORE_SHA}"
           else
             echo "web=true" >> "${GITHUB_OUTPUT}"
             exit 0
           fi
 
-          if git diff --quiet "${compare_ref}" HEAD -- apps/web .github/workflows/apps-web-check.yml; then
+          # A tree diff needs the compared commit, not its history. When that
+          # commit or the diff is unavailable, every web check runs.
+          fetched=false
+          for attempt in $(seq "${FETCH_ATTEMPTS}"); do
+            if git fetch --no-tags --no-recurse-submodules --depth=1 origin "${fetch_refspec}"; then
+              fetched=true
+              break
+            fi
+            if [ "${attempt}" -lt "${FETCH_ATTEMPTS}" ]; then
+              echo "::warning::Fetching ${compare_ref} failed (attempt ${attempt} of ${FETCH_ATTEMPTS}); retrying."
+              sleep "${FETCH_RETRY_DELAY_SECONDS}"
+            fi
+          done
+          if [ "${fetched}" != true ]; then
+            echo "::warning::Could not fetch ${compare_ref} after ${FETCH_ATTEMPTS} attempts; running every web check."
+            echo "web=true" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+          git count-objects -v
+
+          diff_status=0
+          git diff --quiet "${compare_ref}" HEAD -- apps/web .github/workflows/apps-web-check.yml || diff_status=$?
+          if [ "${diff_status}" -eq 0 ]; then
             echo "web=false" >> "${GITHUB_OUTPUT}"
           else
+            if [ "${diff_status}" -ne 1 ]; then
+              echo "::warning::Could not diff against ${compare_ref}; running every web check."
+            fi
             echo "web=true" >> "${GITHUB_OUTPUT}"
           fi
 

.github/workflows/build-check.yml

@@ -27,12 +27,21 @@ jobs:
           # dist/protocol/ are ~1.1 GiB of the ~1.9 GiB HEAD payload and no
           # step in this job reads them from disk (build:protocol-tarball only
           # writes latest.tgz; the immutable-artifact check reads git trees).
+          # History stays because the immutable-artifact check diffs
+          # base...HEAD and treats a version without a local v<version> tag as
+          # unreleased, so a shallow, tagless clone would skip its protection.
           filter: blob:none
           sparse-checkout: |
             /*
             !/dist/protocol/
           sparse-checkout-cone-mode: false
 
+      - name: Report checkout footprint
+        # With the checkout step's duration, these counts show what it fetched (#8559).
+        run: |
+          git rev-parse --is-shallow-repository
+          git count-objects -vH
+
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
@@ -188,8 +197,17 @@ jobs:
           # checked out (no sparse set), so every committed archive, doc and
           # schema stays on disk. Deferring historical-only blobs reduces
           # Git storage without omitting current release fixtures.
+          # Refs and history stay: the docs navigation test reads the stable
+          # maintenance branch and the withdrawn-release marker test checks
+          # real history, and both only weaken on a shallow clone.
           filter: blob:none
 
+      - name: Report checkout footprint
+        # With the checkout step's duration, these counts show what it fetched (#8559).
+        run: |
+          git rev-parse --is-shallow-repository
+          git count-objects -vH
+
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
@@ -289,12 +307,18 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
-          # History blobs are fetched on demand; the whole tip tree is still
-          # checked out (no sparse set), so every committed archive, doc and
-          # schema stays on disk. Deferring historical-only blobs reduces
-          # Git storage without omitting current release fixtures.
-          filter: blob:none
+          # The server suites read no Git history (only `git rev-parse HEAD`),
+          # so only the tested commit is fetched. A full-history fetch of every
+          # branch and tag used most of this job's budget (#8559). The whole tip
+          # tree is still checked out, so every committed archive, doc and
+          # schema stays on disk.
+          fetch-depth: 1
+
+      - name: Report checkout footprint
+        # With the checkout step's duration, these counts show what it fetched (#8559).
+        run: |
+          git rev-parse --is-shallow-repository
+          git count-objects -vH
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
@@ -362,18 +386,25 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
-          # Same partial checkout as build-worker. Full history, refs and tags
-          # stay; only the committed release tarballs under dist/protocol/
+          # Same sparse set as build-worker, without history: the integration
+          # suites read no Git history, so only the tested commit is fetched
+          # (#8559). The committed release tarballs under dist/protocol/
           # (~1.1 GiB) are left unmaterialized. Integration setup builds
           # schemas/latest from source, and the one /protocol assertion
           # (schema-routing.test.ts) builds and mounts its own temp tarball.
+          fetch-depth: 1
           filter: blob:none
           sparse-checkout: |
             /*
             !/dist/protocol/
           sparse-checkout-cone-mode: false
 
+      - name: Report checkout footprint
+        # With the checkout step's duration, these counts show what it fetched (#8559).
+        run: |
+          git rev-parse --is-shallow-repository
+          git count-objects -vH
+
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:

.github/workflows/changeset-check.yml

@@ -39,27 +39,33 @@ jobs:
     # - Release docs snapshot PRs (`auto/docs-v*`) — they freeze docs for an
     #   already-published version and do not represent a new package release.
     if: ${{ !startsWith(github.head_ref, 'changeset-release/') && !startsWith(github.head_ref, 'forward-merge/') && !startsWith(github.head_ref, 'auto/docs-v') }}
+    env:
+      BASE_REF: ${{ github.base_ref }}
     steps:
       - uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0
+
+      # Both checks below compare against the merge base with the target
+      # branch. Only that much history is fetched instead of every branch and
+      # tag (#8559); the step fails when no merge base can be found.
+      - name: Fetch merge base with the target branch
+        run: bash scripts/fetch-merge-base.sh "${BASE_REF}"
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
           node-version: '24'
 
       - name: Check changeset protocol scope
-        run: node scripts/check-changeset-protocol-scope.cjs origin/${{ github.base_ref }}
+        run: node scripts/check-changeset-protocol-scope.cjs "origin/${BASE_REF}"
 
       - name: Check for changeset
         run: |
-          if node scripts/check-changeset-protocol-scope.cjs origin/${{ github.base_ref }} --is-status-exempt-maintenance; then
+          if node scripts/check-changeset-protocol-scope.cjs "origin/${BASE_REF}" --is-status-exempt-maintenance; then
             echo "Skipping changesets status for changeset policy maintenance."
             exit 0
           fi
-          if ! node scripts/check-changeset-protocol-scope.cjs origin/${{ github.base_ref }} --has-protocol-scoped-changes; then
+          if ! node scripts/check-changeset-protocol-scope.cjs "origin/${BASE_REF}" --has-protocol-scoped-changes; then
             echo "Skipping changesets status because this PR does not touch the protocol release surface."
             exit 0
           fi
-          npx --yes @changesets/cli@^3.0.0 status --since=origin/${{ github.base_ref }}
+          npx --yes @changesets/cli@^3.0.0 status "--since=origin/${BASE_REF}"

.github/workflows/check-image-alt-text.yml

@@ -7,6 +7,8 @@ on:
       - 'docs/**/*.mdx'
       - 'docs/**/*.md'
       - 'images/**'
+      - 'scripts/fetch-merge-base.sh'
+      - '.github/workflows/check-image-alt-text.yml'
 
 jobs:
   check-images:
@@ -17,7 +19,11 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
+
+      # Changed images are found by diffing against the merge base with main;
+      # only that much history is fetched (#8559).
+      - name: Fetch merge base with main
+        run: bash scripts/fetch-merge-base.sh main
 
       - uses: actions/setup-node@v7
         with:
@@ -32,8 +38,9 @@ jobs:
           ERRORS=""
           WARNINGS=""
 
-          # Get files changed in this PR
-          CHANGED_FILES=$(git diff --name-only origin/main...HEAD 2>/dev/null || echo "")
+          # Get files changed in this PR. A failed diff stops the step instead
+          # of silently skipping the image quality checks.
+          CHANGED_FILES=$(git diff --name-only origin/main...HEAD)
 
           # Extract all <img src="/images/..." alt="..." from MDX files
           # Handles both single-line and multiline img tags

.github/workflows/check-migration-numbers.yml

@@ -32,8 +32,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0
+
+      # Pull requests and merge groups compare against current main and its
+      # merge base; only that much history is fetched (#8559). Push, schedule
+      # and manual runs read only the checked-out tree.
+      - name: Fetch merge base with main
+        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
+        run: bash scripts/fetch-merge-base.sh main
 
       - name: Check for duplicate migration numbers against current main
         run: |
@@ -48,7 +53,6 @@ jobs:
           # migration filenames on the PR branch AND on origin/main, then
           # hunting dupes in that union. The merge_group/push/schedule
           # triggers cover the case where two PRs slip through in parallel.
-          git fetch origin main --depth=1 2>/dev/null || true
 
           # Files on this ref (PR's speculative merge, merge-group commit, or main).
           local_files=$(ls server/src/db/migrations/*.sql 2>/dev/null | xargs -n1 basename || true)

.github/workflows/check-testable-snippets.yml

@@ -9,27 +9,39 @@ on:
       - 'scripts/check-testable-snippets.cjs'
       - 'scripts/docs-example-coverage.cjs'
       - 'scripts/docs-json-field-audit.cjs'
+      - 'scripts/fetch-merge-base.sh'
       - '.github/workflows/check-testable-snippets.yml'
 
 jobs:
   check-snippets:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0  # Need full history for diff
+
+      # The snippet check diffs against the merge base with the target branch;
+      # only that much history is fetched (#8559).
+      - name: Fetch merge base with the target branch
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: bash scripts/fetch-merge-base.sh "${BASE_REF}"
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
           node-version: '24'
 
       - name: Check for untested code snippets
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          git fetch origin ${{ github.base_ref }}
-          git diff origin/${{ github.base_ref }}...HEAD --name-only | grep -E '\.(md|mdx)$' > changed_files.txt || true
+          set -euo pipefail
+          changed=$(git diff --name-only "origin/${BASE_REF}...HEAD")
+          printf '%s\n' "${changed}" | grep -E '\.(md|mdx)$' > changed_files.txt || true
 
           if [ -s changed_files.txt ]; then
+            # The clone is blobless below HEAD and the checker diffs one file at
+            # a time; one diff first fetches every missing blob in a single batch.
+            xargs -d '\n' git diff "origin/${BASE_REF}...HEAD" -- < changed_files.txt > /dev/null
             echo "📋 Checking documentation changes for testable snippets..."
             node scripts/check-testable-snippets.cjs
           else