scripts/check-attribution-trailers.sh

@@ -16,54 +16,24 @@ set -eu
 
 trailer_re='^[[:space:]]*co-authored-by:.*(claude|anthropic|noreply@anthropic\.com)'
 
-branch="${GITHUB_BASE_REF:-main}"
+if [ -n "${GITHUB_BASE_REF:-}" ]; then
-
+  base="origin/${GITHUB_BASE_REF}"
-# Remote name varies by checkout — CI's actions/checkout@v3 names it
-# `origin`, but an agent worktree renames its remote to `forge` (see the
-# hive's subagent briefs). Hardcoding `origin/` here made the script
-# unresolvable, and unresolvable, in the old code, silently read as clean
-# (fetch-or-`true`, then a fallback to `HEAD~10`) — that fail-open was the
-# actual bug. So: try `BASE_REF` if the caller set one, then every
-# configured remote in a stable order (an `origin` remote first, to match
-# CI, then the rest alphabetically), fetching a remote's copy of `branch`
-# if it isn't already present locally. If none of that resolves a base,
-# exit 1 with a clear message — never guess a commit range.
-base=""
-if [ -n "${BASE_REF:-}" ]; then
-  if git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
-    base="$BASE_REF"
 else
-    echo "check-attribution-trailers: BASE_REF=$BASE_REF does not resolve" >&2
+  base="origin/main"
-    exit 1
 fi
-else
-  remotes="$(git remote)"
-  ordered_remotes=""
-  if printf '%s\n' "$remotes" | grep -qx origin; then
-    ordered_remotes="origin"
-  fi
-  for r in $(printf '%s\n' "$remotes" | sort); do
-    [ "$r" = "origin" ] && continue
-    ordered_remotes="${ordered_remotes:+$ordered_remotes }$r"
-  done
 
-  for remote in $ordered_remotes; do
-    candidate="refs/remotes/${remote}/${branch}"
-    if ! git rev-parse --verify "$candidate" >/dev/null 2>&1; then
 # actions/checkout@v3 fetches the PR head but may not fetch the base branch
-      git fetch "$remote" "$branch" 2>/dev/null || true
+if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
-    fi
+  branch="${base#origin/}"
-    if git rev-parse --verify "$candidate" >/dev/null 2>&1; then
+  git fetch origin "$branch" 2>/dev/null || true
-      base="$candidate"
+  if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
-      break
+    base="origin/main"
-    fi
+    if ! git fetch origin main 2>/dev/null || ! git rev-parse --verify "$base" >/dev/null 2>&1; then
-  done
+      echo 'check-attribution-trailers: base ref unresolvable — cannot fetch origin/main to diff against, refusing to guess a commit range' >&2
-
-  if [ -z "$base" ]; then
-    echo "check-attribution-trailers: base ref unresolvable — no configured remote has a '${branch}' ref (tried: ${remotes:-none}), refusing to guess a commit range" >&2
       exit 1
     fi
   fi
+fi
 
 # `|| true` here used to erase git log's own exit status, so a genuine
 # failure (bad range, corrupt ref) and a merely-empty range read the same: