ci: bound history fetches for path checks and server test shards - #8955

Closes #8559

Problem

Several verification lanes checked out with fetch-depth: 0, which fetches every branch (about 2,070) and every tag before any check runs. #8559 shows the apps/web check spending its whole 10-minute budget in checkout, and a server unit shard spending 14m49s of 20 there. Most of these lanes only diff two snapshots or diff against the merge base; the server suites read no history at all.

Changes

Audit

There are no composite actions under .github/actions/.

scripts/fetch-merge-base.sh

Fetches commits and trees (no blobs) for origin/<base> and HEAD with a doubling depth (50 up to 3,200) until origin/<base>...HEAD has an exact merge base. Then it falls back to the complete history of those two refs, and exits non-zero if there is still no merge base. Two details matter:

• After the first fetch the base tip is pinned by SHA. Git skips an up-to-date ref when another commit is also wanted, so otherwise only HEAD deepens.
• A merge base is accepted only when no shallow boundary lies between it and either tip. Without this, a shallow graph can return an older common ancestor, such as a release commit merged into both sides.

It prints the merge base, the depth that found it, the elapsed time and git count-objects -v. Each fetch is tried 3 times, 5 s apart, as actions/checkout does for its own fetches. If the last attempt fails, or git merge-base or git rev-list errors, it exits with ::error::.

.github/workflows/apps-web-check.yml

Depth-1 checkout, then a depth-1 fetch of the compared commit (3 attempts). The tree diff is unchanged. If that commit still cannot be fetched, or the diff errors, every web check runs with a warning. The stable required context is unchanged.

.github/workflows/build-check.yml

Server unit and integration shards check out depth 1. Every worker gets a "Report checkout footprint" step, so CI shows what each checkout fetched next to its duration. The build worker and canonical shards keep full history, with comments saying why.

Merge-base lanes

changeset-check.yml, check-testable-snippets.yml, check-image-alt-text.yml and check-migration-numbers.yml run the script before diffing.

• A failed diff now stops the image check and the snippet check instead of reading as "no changes".
• The image and snippet lanes now also trigger on scripts/fetch-merge-base.sh, and the image lane on its own workflow file, so this PR's CI exercises them.
• The snippet lane fetches the changed docs' blobs in one batch before its per-file checker runs.
• changeset-check.yml takes the base ref from a job-level BASE_REF instead of interpolating ${{ github.base_ref }} into run:.

Tests

• New tests/ci-bounded-checkout.test.mjs (22 tests, run by test:unit) runs the script and the real apps/web detector step against file:// shallow clones of a fixture repo. A git stub on PATH injects failures. Each fix fails its test when reverted. It covers:
  • a merge base deeper than the first window, on the base side only;
  • a decoy ancestor from a forward-merged release branch;
  • the full-history fallback, unrelated history and invalid input;
  • a failed rev-list, and fetch retries (recovery and exhaustion);
  • PR and push web detection, including a recovered fetch, a failed fetch and a failed diff;
  • that the changed lanes keep bounded checkouts.
• Dry run against six real merged PRs (fix(tmp): isolate context caches by evaluation namespace #7446, fix(adagents): origin-only authorized_agents urls authorize the agent at that origin #8939, feat(schema): add card_image_sizes to image_carousel #8937, chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #7388, docs(creative): sellers accept creatives that conform to the declared format option #8941, fix(training-agent): accept native creatives that fit the declared format option #8940) using a mirror of the repository's heads and tags: merge bases and changed-file lists (--name-only, --name-status --find-renames) match full history in all 50 comparisons, including chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #7388, whose merge base is 1,039 main commits back.
• Local footprint for the apps/web fetch: 101,328 objects / 24 MiB / 2,196 refs before, 11,852 objects / 5 MiB / 2 refs after.
• Local timing of the server unit shard pattern (full tip tree): full history with blob:none took 1.8 s to fetch and 462 s to check out, because the 1.3 GiB tip arrives through lazy blob fetches. Depth 1 took 32 s plus 61 s (one pack). Local timings do not reproduce GitHub latency; the new footprint steps are there to measure fresh runners.
• test-coverage-registration, changeset-protocol-scope and release-workflow-immutability pass.

Decisions for reviewers

1. apps/web when the compare fails. If the compared commit cannot be fetched after 3 attempts, or the diff errors, every web check runs with a warning; the job does not fail. The issue asks to "fail closed". This choice never reports unexecuted checks as passing, but a maintainer should confirm it.
2. Window and retry sizes. The helper starts at 50 commits and doubles up to 3,200 before falling back to full history. Fetches are tried 3 times, 5 s apart. In the dry run, five of six PRs resolved in the first window; chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #7388 needed 800.
3. Integration shard. It keeps blob:none plus the sparse set, so about 0.8 GiB of blobs still arrive through lazy fetches. Locally, that path dominated full-tree checkout time. Watch the new footprint step, and switch to a plain depth-1 fetch if it stays slow.
4. Merge-base lanes still fetch the full tip with blobs (about 1.3 GiB, including dist/protocol/ tarballs none of them read). filter: blob:none plus a !/dist/protocol/ sparse set is a likely bigger win, left as a follow-up.
5. Blast radius. The helper now runs in front of Check for changeset on every PR. To land with less risk, the apps/web and server-shard changes (the failures in the issue) could go in first, and the merge-base lanes after.

Out of scope / follow-ups

• Build worker: a bounded checkout would need the merge base plus every release tag, because a missing tag disables the immutable-artifact check.
• Canonical shards: need origin/<stable>.x and real history for two tests.
• training-agent-storyboards.yml appears to need only the origin/3.0.x tip, but it is a protocol-scoped workflow.
• The acceptance runs on fresh runners need CI.
• Merge-base lanes: blob:none plus a sparse set without dist/protocol/ (decision 4).

🤖 Generated with Claude Code