verify-security-review-evidence.sh shallows the base ref, so the guard fails with 'no merge base' on any branch behind main

[kyle-sexton]

What's wrong

scripts/verify-security-review-evidence.sh:158 fetches the base ref shallow:

git fetch origin "$base_ref" --depth=1 >/dev/null 2>&1 || true

.github/workflows/claude-security-review.yml:93 already checks out with fetch-depth: 0, so the
full history is present before this line runs. The --depth=1 fetch then truncates that ref to a
single commit, and the scope check immediately asks for a three-dot diff against it:

["git", "diff", "--name-only", f"origin/{base_ref}...HEAD"]

A three-dot diff needs a merge base. Once origin/main is a lone commit with no ancestry, there is
none unless the PR branch happens to be based on main's current tip — so the guard dies with:

fatal: origin/main...HEAD: no merge base

Blast radius

Any PR whose branch is behind origin/main when the workflow runs — which, at this repo's merge
rate, is most PRs more than a few minutes old. Observed on #2539: reproduced across two independent
runs (31655807987 jobs 94310219602 and 94312908610), deterministic, not flaky. The branch was
7 commits behind main at the time.

The failure is fail-closed, which is the right default and is clearly deliberate in the script's own
comments — but the guard is erroring rather than evaluating, so it never reaches the evidence check
it exists to perform, and it is red on PRs it has nothing to say about. security-review-evidence is
not in the ruleset's required-checks list, so it does not block merges; it just goes red.

Fix

Drop --depth=1:

git fetch origin "$base_ref" >/dev/null 2>&1 || true

The workflow's fetch-depth: 0 checkout already supplies full history, so this is not a cost
regression — it is a normal fetch against an already-complete clone. Nothing about the guard's
fail-closed posture changes; it simply gets a usable merge base and evaluates scope as designed.

Worth deciding alongside the fix: whether the script should defend against being called from a
shallow clone at all (git rev-parse --is-shallow-repository → --unshallow). Its only caller today
checks out full history, so that may be scaffolding for a case that does not exist — noting it as a
question rather than a requirement.

Verification

scripts/verify-security-review-evidence.sh.test.sh exists and should cover the behind-main case,
which currently has no test — a branch several commits behind its base should reach a scope verdict
rather than dying on the diff.

[kyle-sexton]

Superseded and resolved by #2548 (04f9cee8, merged 2026-08-13T03:32Z), not by the fix drafted for it.

#2548 rewrote scripts/verify-security-review-evidence.sh so that it no longer derives scope itself. The shallow git fetch origin "$base_ref" --depth=1 and the origin/<base>...HEAD three-dot diff described here are both gone — the script on main now performs zero git operations and reads scope from the lane's declared relevant output, passed in from needs.security-review.outputs.relevant (ci-workflows v0.14.2). The lane computes that relevance server-side via pulls.listFiles / compareCommitsWithBasehead, so there is no local clone depth to truncate and no merge base to lose.

Verified against origin/main rather than a branch:

• git cat-file -p origin/main:scripts/verify-security-review-evidence.sh contains no git invocation at all (one match is prose inside a comment).
• The guard now reaches a scope verdict on branches behind main. Three PRs merged after fix(security-evidence): decide from the lane's declared verdict, not its log #2548, with their head measured against the pre-merge tip of main:
  • fix(work-items): make umbrella-fold routing atomic in triage (#633) #2550 — 5 commits behind — security-review-evidence: success
  • fix(disk-hygiene): launch wired hooks through bash Python resolver (#1504) #2551 — 6 commits behind — security-review-evidence: success
  • fix(session-flow): resume observer when transcript growth returns (#1471) #2552 — 7 commits behind — security-review-evidence: success

The open question raised in this issue — whether the script should defend against a genuinely shallow clone via git rev-parse --is-shallow-repository / --unshallow — dies with the fetch. There is no fetch to harden, so no follow-up issue is filed.

PR #2554 was closed unmerged for this reason; its branch fix/security-review-evidence-merge-base targeted a code path that no longer exists and has been deleted.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as completed (superseded).

PR #2554 closed as superseded by #2548, which removed the shallow-fetch three-dot scope check entirely in favor of lane-declared LANE_RELEVANT outputs. The 'no merge base' failure mode no longer applies to that path.