ci: fix PR path filter base diff

.gitea/scripts/detect-changes.py

@@ -74,12 +74,37 @@ def base_exists(base: str) -> bool:
     return run_git(["cat-file", "-e", base]).returncode == 0
 
 
-def fetch_base(base: str) -> None:
-    run_git(["fetch", "--depth=1", "origin", base])
+def fetch_base(base: str, base_ref: str) -> None:
+    # Gitea may reject fetching an arbitrary unadvertised SHA from a shallow
+    # PR checkout. Fetch the advertised base branch first, then fall back to
+    # the SHA for hosts that allow it.
+    if base_ref:
+        run_git(["fetch", "--depth=1", "origin", base_ref])
+    if not base_exists(base):
+        run_git(["fetch", "--depth=1", "origin", base])
 
 
-def changed_paths(base: str) -> list[str] | None:
-    proc = run_git(["diff", "--name-only", base, "HEAD"])
+def deepen_base_ref(base_ref: str) -> None:
+    if base_ref:
+        run_git(["fetch", "--deepen=200", "origin", base_ref], timeout=60)
+
+
+def merge_base(base: str) -> str | None:
+    proc = run_git(["merge-base", base, "HEAD"])
+    if proc.returncode != 0:
+        return None
+    value = proc.stdout.strip()
+    return value or None
+
+
+def changed_paths(base: str, *, use_merge_base: bool) -> list[str] | None:
+    compare_base = base
+    if use_merge_base:
+        compare_base = merge_base(base) or ""
+        if not compare_base:
+            return None
+
+    proc = run_git(["diff", "--name-only", compare_base, "HEAD"])
     if proc.returncode != 0:
         return None
     return [line for line in proc.stdout.splitlines() if line]
@@ -96,17 +121,27 @@ def write_outputs(values: dict[str, bool], output_path: str | None) -> None:
             print(line)
 
 
-def detect(profile: str, event_name: str, pr_base_sha: str, push_before: str) -> dict[str, bool]:
+def detect(
+    profile: str,
+    event_name: str,
+    pr_base_sha: str,
+    push_before: str,
+    base_ref: str = "",
+) -> dict[str, bool]:
     base = resolve_base(event_name, pr_base_sha, push_before)
     if is_zero_sha(base):
         return all_true(profile)
 
     if not base_exists(base):
-        fetch_base(base)
+        fetch_base(base, base_ref)
     if not base_exists(base):
         return all_true(profile)
 
-    paths = changed_paths(base)
+    use_merge_base = event_name == "pull_request"
+    if use_merge_base and base_ref and merge_base(base) is None:
+        deepen_base_ref(base_ref)
+
+    paths = changed_paths(base, use_merge_base=use_merge_base)
     if paths is None:
         return all_true(profile)
     return classify(profile, paths)
@@ -117,13 +152,20 @@ def parse_args(argv: list[str]) -> argparse.Namespace:
     parser.add_argument("--profile", required=True, choices=sorted(PROFILES))
     parser.add_argument("--event-name", default=os.environ.get("GITHUB_EVENT_NAME", ""))
     parser.add_argument("--pr-base-sha", default="")
+    parser.add_argument("--base-ref", default="")
     parser.add_argument("--push-before", default=os.environ.get("GITHUB_EVENT_BEFORE", ""))
     return parser.parse_args(argv)
 
 
 def main(argv: list[str]) -> int:
     args = parse_args(argv)
-    values = detect(args.profile, args.event_name, args.pr_base_sha, args.push_before)
+    values = detect(
+        args.profile,
+        args.event_name,
+        args.pr_base_sha,
+        args.push_before,
+        args.base_ref,
+    )
     write_outputs(values, os.environ.get("GITHUB_OUTPUT"))
     return 0
 

.gitea/workflows/ci.yml

@@ -88,12 +88,14 @@ jobs:
       - id: check
         env:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
           PUSH_BEFORE: ${{ github.event.before }}
         run: |
           python3 .gitea/scripts/detect-changes.py \
             --profile ci \
             --event-name "${{ github.event_name }}" \
             --pr-base-sha "$PR_BASE_SHA" \
+            --base-ref "$PR_BASE_REF" \
             --push-before "${GITHUB_EVENT_BEFORE:-$PUSH_BEFORE}"
 
   # Platform (Go) — Go build/vet/test/lint + coverage gates. The always-run

.gitea/workflows/e2e-api.yml

@@ -137,6 +137,7 @@ jobs:
             --profile e2e-api \
             --event-name "${{ github.event_name }}" \
             --pr-base-sha "${{ github.event.pull_request.base.sha }}" \
+            --base-ref "${{ github.event.pull_request.base.ref }}" \
             --push-before "${GITHUB_EVENT_BEFORE:-${{ github.event.before }}}"
 
   # ONE job (no job-level `if:`) that always runs and reports under the

.gitea/workflows/handlers-postgres-integration.yml

@@ -106,6 +106,7 @@ jobs:
             --profile handlers-postgres \
             --event-name "${{ github.event_name }}" \
             --pr-base-sha "${{ github.event.pull_request.base.sha }}" \
+            --base-ref "${{ github.event.pull_request.base.ref }}" \
             --push-before "${GITHUB_EVENT_BEFORE:-}"
 
   # Single-job-with-per-step-if pattern: always runs to satisfy the

tests/test_detect_changes.py

@@ -78,3 +78,116 @@ def test_fail_open_all_true_for_missing_base():
         "python": True,
         "scripts": True,
     }
+
+
+def test_fetch_base_prefers_advertised_base_ref(monkeypatch):
+    mod = load_module()
+    calls: list[list[str]] = []
+    exists_checks = 0
+
+    def fake_base_exists(base: str) -> bool:
+        nonlocal exists_checks
+        exists_checks += 1
+        return exists_checks >= 1
+
+    def fake_run_git(args: list[str], *, timeout: int = 30):
+        calls.append(args)
+
+        class Result:
+            returncode = 0
+            stdout = ""
+            stderr = ""
+
+        return Result()
+
+    monkeypatch.setattr(mod, "base_exists", fake_base_exists)
+    monkeypatch.setattr(mod, "run_git", fake_run_git)
+
+    mod.fetch_base("abc123", "main")
+
+    assert calls == [["fetch", "--depth=1", "origin", "main"]]
+
+
+def test_fetch_base_falls_back_to_sha_when_ref_fetch_does_not_materialize(monkeypatch):
+    mod = load_module()
+    calls: list[list[str]] = []
+
+    monkeypatch.setattr(mod, "base_exists", lambda _base: False)
+
+    def fake_run_git(args: list[str], *, timeout: int = 30):
+        calls.append(args)
+
+        class Result:
+            returncode = 0
+            stdout = ""
+            stderr = ""
+
+        return Result()
+
+    monkeypatch.setattr(mod, "run_git", fake_run_git)
+
+    mod.fetch_base("abc123", "main")
+
+    assert calls == [
+        ["fetch", "--depth=1", "origin", "main"],
+        ["fetch", "--depth=1", "origin", "abc123"],
+    ]
+
+
+def test_changed_paths_uses_merge_base_for_pull_request(monkeypatch):
+    mod = load_module()
+    calls: list[list[str]] = []
+
+    def fake_run_git(args: list[str], *, timeout: int = 30):
+        calls.append(args)
+
+        class Result:
+            returncode = 0
+            stdout = "workspace/agent.py\n"
+            stderr = ""
+
+        if args[0] == "merge-base":
+            Result.stdout = "merge123\n"
+        return Result()
+
+    monkeypatch.setattr(mod, "run_git", fake_run_git)
+
+    assert mod.changed_paths("base123", use_merge_base=True) == ["workspace/agent.py"]
+    assert calls == [
+        ["merge-base", "base123", "HEAD"],
+        ["diff", "--name-only", "merge123", "HEAD"],
+    ]
+
+
+def test_detect_deepens_base_ref_when_pr_merge_base_missing(monkeypatch):
+    mod = load_module()
+    calls: list[tuple[str, str | None]] = []
+    merge_base_calls = 0
+
+    monkeypatch.setattr(mod, "base_exists", lambda _base: True)
+
+    def fake_merge_base(base: str):
+        nonlocal merge_base_calls
+        merge_base_calls += 1
+        if merge_base_calls == 1:
+            return None
+        return "merge123"
+
+    def fake_deepen_base_ref(base_ref: str):
+        calls.append(("deepen", base_ref))
+
+    def fake_changed_paths(base: str, *, use_merge_base: bool):
+        calls.append(("changed", str(use_merge_base)))
+        return [".gitea/workflows/ci.yml"]
+
+    monkeypatch.setattr(mod, "merge_base", fake_merge_base)
+    monkeypatch.setattr(mod, "deepen_base_ref", fake_deepen_base_ref)
+    monkeypatch.setattr(mod, "changed_paths", fake_changed_paths)
+
+    assert mod.detect("ci", "pull_request", "base123", "", "main") == {
+        "platform": False,
+        "canvas": False,
+        "python": False,
+        "scripts": False,
+    }
+    assert calls == [("deepen", "main"), ("changed", "True")]