fix(osv-verdict): make merge-base reachable on shallow MR clones

Andrew Dunnrequested to merge
fix-osv-verdict-merge-base-reachability into main

The defect

osv-verdict runs in diff mode on MR pipelines (fail only on newly-introduced advisories) by checking out the merge-base (CI_MERGE_REQUEST_DIFF_BASE_SHA) and scanning it as a baseline. On the default shallow MR clone (GIT_DEPTH=20) the base SHA is usually absent from the local repo, so the checkout silently failed and the job fell back to a FULL scan. That blocks every Renovate MR on any consumer repo carrying a pre-existing advisory, even when the bump introduces nothing new. The job set GIT_DEPTH:0 but that does not reliably override the project clone depth on MR pipelines.

The fix

Before the diff scan, make the base genuinely reachable: git fetch --deepen=100, then fetch the exact base SHA, then --unshallow as a last resort. The job only diff-scans when the base resolves to a real commit object (git cat-file -e).

Failure semantics are tightened, not relaxed:

  • Base still unreachable on an MR after deepen/unshallow: a true setup fault, not a non-MR context, so the job fail-closes (CHECK_OSV=fail) rather than silently full-scanning and blocking on pre-existing findings.
  • Base scan errors, or base reachable but checkout fails: also fail-closed.
  • Non-MR contexts (branch/main): keep the full-scan path unchanged.

exit-128=clean and the fail-closed default are unchanged. The gate is not relaxed to force-green. The install method (checksum-verified osv-scanner binary on the ci-tools image) is unchanged.

Validation

  • YAML parses (multi-doc) and the script block passes bash -n and shellcheck (only SC2148, expected for a CI fragment).
  • Reproduced the defect and the fix on a real depth-20 shallow clone: a base 25 commits deep is ABSENT after the shallow clone (the defect trigger); the fetch recovers it at the first --deepen=100 step and the base checkout then succeeds, so the diff-scan path is taken instead of full-scan.

Human gate

This repo ships to customers. This MR is opened for human review and is NOT to be merged by automation.

Release recommendation

The latest released tag (v4.0.2) predates the L0 gate components (osv-verdict + automerge-gate) that landed on main in MR!75 at SHA 17f42289, and predates this fix. Consumers currently have to pin a main SHA. After this MR is reviewed and merged, please cut a new tag (recommend v4.1.0, a minor: it adds the gate component surface) that includes both the gate components AND this fix. That lets consumers pin a tag instead of a main SHA.

Known waiting consumer: andunn/den MR!2 pins this repo at main SHA 17f42289 with a matching ci-tools:17f42289 image override, and is explicitly waiting on a v4.1.0+ tag to repin the @ref and drop the image override.

Merge request reports