Recognize merged base ancestors when the base tip advances by Copilot · Pull Request #69998 · github/gh-aw

Copilot · 2026-10-18T20:43:13Z

Summary

When the base branch advances after an agent merges it, unsigned bundle validation can fall back to the old PR head and count upstream changes against the agent's size limits. This PR adds opt-in recognition of merged base ancestors without fetching base objects or weakening protected-file checks.

Behavior

Preserve default recognition of the exact pinned base tip, with no REST comparisons when local ancestry proves it is merged.
Enable older-ancestor discovery only with literal allow-merged-base-baseline: true under safe-outputs.push-to-pull-request-branch. The schema/compiler forward this setting, and relevant patch-size failures point to the opt-in.
Inspect newly incorporated merge parents in topological order and confirm reachability against the base tip pinned by exact-ref git ls-remote.
Use confirmed non-tip ancestors only for size accounting. Protected-file and history checks remain relative to the old PR head, including side-branch changes later reverted. Only the exact pinned tip can exempt upstream history and unmodified files.

safe-outputs:
  push-to-pull-request-branch:
    allow-merged-base-baseline: true

Safety and implementation

Bound optional Git commands to 5 seconds and 1 MiB per output stream; cap history scans at 100 records and REST discovery at four comparisons, each with a 5-second abort deadline and retries disabled. Only candidate-specific 404 errors allow comparison discovery to continue.
Keep local inspection offline, blocking promisor lazy downloads and preserving shallow/partial checkouts. Inconclusive discovery retains conservative PR-head validation.
Keep allow-full-history-fetch separate and disabled by default. Only literal opt-in permits potentially unbounded prerequisite recovery, using the handler-selected repository credentials; it never enables optional baseline downloads.
Reuse shared Git execution in git_helpers.cjs instead of a handler-local getExecOutput replacement. Preserve append-only delivery, credential separation, conflict-resolution checks, and octopus-merge rejection.
Update the safe-output reference and normative specification, add a bounded TLA+ Git-operation model with negative controls and reachability witnesses, and extend unit/real-Git regression coverage.

Fixes push_to_pull_request_branch: recognize a merged base commit that is behind the current base tip in bundle validation #69912

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-10-18T21:37:33Z

/matt

github-actions · 2026-10-18T21:38:09Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

Copilot

🟡 Changes recommended

Ancestor-based exemptions can allow protected-file changes to escape validation.

2 open issues

What changed in this PR

Recognizes merged base ancestors when the base tip advances, preventing upstream changes from inflating unsigned bundle validation limits.

Changes:

Confirms merged ancestors against the pinned tip through REST comparisons.
Reuses the confirmed baseline for validation and history exclusions.
Adds coverage for advanced bases and offline object inspection.

File	Description
actions/setup/js/push_to_pull_request_branch.test.cjs	Tests ancestry confirmation, fallback, and validation safeguards.
actions/setup/js/push_to_pull_request_branch.integration.test.cjs	Covers advanced-base validation scenarios.
actions/setup/js/push_to_pull_request_branch.cjs	Resolves and applies trusted ancestor baselines.
actions/setup/js/bundle_transport.integration.test.cjs	Checks newest-ancestor selection without fetching objects.

_{Review effort: Max}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs to the new resolveBundleTrustedBase fix for issue #69912.

📋 Key Themes & Highlights

Key Themes

Unbounded API fan-out: the merge-parent comparison loop in resolveBundleTrustedBase (push_to_pull_request_branch.cjs:237-247) issues one compareCommits REST call per candidate parent with no cap and no retry/backoff, unlike the withRetry/RATE_LIMIT_RETRY_CONFIG pattern used elsewhere in this file. Since the candidate set is derived from agent-supplied bundle content, a bundle crafted with many merge commits could drive a large, uncapped number of API calls per push.

Positive Highlights

✅ Core approach (offline topological ordering + single-parent REST confirmation, newest-first) is sound and well-documented.
✅ Strong regression coverage: new integration test in bundle_transport.integration.test.cjs exercises a realistic advancing-base scenario end-to-end, and the unit test matrix (push_to_pull_request_branch.test.cjs) is thoughtfully expanded with a baseAdvanced dimension covering compare-status variants.
✅ Safeguards preserved: PR-head fallback on any failure, no fetches, error messages scrubbed of remote diagnostics before logging.

Left one inline comment on the unbounded loop; everything else looks solid.

@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 107.9 AIC · ⌖ 16.2 AIC · ⊞ 10.1K
_{Comment /matt to run again}

github-actions · 2026-10-18T21:56:29Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · opus55 · 11.1 AIC · ⌖ 36.3 AIC · ◇ 14.6 AIC · ⊞ 1.9K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-18T21:56:31Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-18T21:56:34Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Matt Pocock Skills Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Matt Pocock Skills Reviewer · sonnet50 · 58.3 AIC · ⌖ 14.7 AIC · ⊞ 10.1K · ◷

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-18T21:56:35Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · 8.82 AIC · ⌖ 5.38 AIC · ⊞ 14.6K · ◷

Generated by Ponytail Reviewer for #69998

github-actions · 2026-10-18T21:56:42Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · haiku45 · 9.23 AIC · ⌖ 8.79 AIC · ◇ 2.53 AIC · ⊞ 9.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-18T22:02:01Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-18T21:58:13.682+00:00
review_event: REQUEST_CHANGES
top_themes:
  - merged-base trust is too broad
  - remote comparison fan-out is unbounded
  - fast-path coverage is missing
files_reviewed:
  - actions/setup/js/bundle_transport.integration.test.cjs
  - actions/setup/js/push_to_pull_request_branch.cjs
  - actions/setup/js/push_to_pull_request_branch.integration.test.cjs
  - actions/setup/js/push_to_pull_request_branch.test.cjs
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 54.7 AIC · ⌖ 5.91 AIC · ⊞ 12.7K · ◷
_{Comment /review to run again}

github-actions

Request changes

The merged-base recognition logic still has merge-blocking trust and scalability gaps: it can treat arbitrary merged ancestors as a trusted base, and it fans out remote comparisons over agent-controlled merge parents.

Blocking themes

resolveBundleTrustedBase is still proving only reachability to the pinned tip, not that the selected commit was ever a base-branch tip. That can exclude the wrong history from protected-file and patch-size validation.
The comparison loop is unbounded over merge parents extracted from the bundle range, so a crafted history can turn validation into a burst of remote API calls before we fall back.
The added tests do not cover the fast path where the pinned tip is already present locally, so regressions in the no-network success path would currently slip through.

Static review only; I did not execute the test suite.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 54.7 AIC · ⌖ 5.91 AIC · ⊞ 12.7K
_{Comment /review to run again}

Keep protected-file and history checks relative to the PR head for non-tip ancestors while retaining their size baseline. Limit ancestor comparisons to four and stop on errors other than missing parents. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

done

…eckouts Cap Git execution time, output, and history scans; abort REST comparisons after five seconds without retries. Keep optional discovery offline and cover unchanged shallow/partial checkout state plus explicit history recovery gating. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Formalize offline baseline discovery, explicit prerequisite recovery, credential roles, and separate size/protection provenance. Add a bounded TLA+ Git-operation model with executable negative controls and reachability witnesses. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan · 2026-10-19T01:46:27Z

@copilot make sure behavior is opt in and and error message information about flag when disabled.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-10-19T02:17:13Z

@copilot make sure behavior is opt in and and error message information about flag when disabled.

Older merged-base ancestor discovery is now opt-in via allow-merged-base-baseline: true; related size-limit errors identify the flag when disabled. Commit: 110094a7.

Remove the handler-local child process executor and getExecOutput replacement. Share structured Git process execution with execGitSync while preserving bounded offline discovery, scrubbed optional diagnostics, and conflict-status handling. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Initial plan

ad6582c

Copilot AI assigned Copilot and pelikhan Oct 18, 2026

Copilot started work on behalf of pelikhan October 18, 2026 20:43

View session

Copilot AI linked an issue Oct 18, 2026 that may be closed by this pull request

push_to_pull_request_branch: recognize a merged base commit that is behind the current base tip in bundle validation #69912

Closed

Recognize merged base ancestors behind the trusted branch tip

36b031c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot mentioned this pull request Oct 18, 2026

[Contribution Check Report] Contribution Check — 2026-10-18 #69811

Closed

Copilot AI changed the title ~~[WIP] Fix bundle validation for merged base commit in PR~~ Recognize merged base ancestors when the base tip advances Oct 18, 2026

Copilot finished work on behalf of pelikhan October 18, 2026 20:59

Copilot AI requested a review from pelikhan October 18, 2026 20:59

pelikhan marked this pull request as ready for review October 18, 2026 21:24

Copilot AI max review requested due to automatic review settings October 18, 2026 21:24

Copilot started reviewing on behalf of pelikhan October 18, 2026 21:25

View session

Copilot AI reviewed Oct 18, 2026

View reviewed changes

Comment thread actions/setup/js/push_to_pull_request_branch.cjs Outdated

Comment thread actions/setup/js/push_to_pull_request_branch.cjs Outdated

github-actions Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread actions/setup/js/push_to_pull_request_branch.cjs Outdated

github-actions Bot previously requested changes Oct 18, 2026

View reviewed changes

Comment thread actions/setup/js/push_to_pull_request_branch.test.cjs

github-actions Bot mentioned this pull request Oct 18, 2026

[pr-sous-chef] PR Sous Chef Report: PR #69813 nudged for implementation #69909

Closed

pelikhan and others added 2 commits October 18, 2026 16:09

github-actions Bot mentioned this pull request Oct 19, 2026

[PR Triage Report] PR triage report - 2026-10-19 #70106

Open

Copilot started work on behalf of pelikhan October 19, 2026 01:46

View session

Gate merged-base ancestor baselines behind opt-in

110094a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan October 19, 2026 02:17

pelikhan merged commit 020a1c6 into main Oct 19, 2026
49 checks passed

pelikhan deleted the copilot/fix-push-to-pull-request-branch-again branch October 19, 2026 03:00

github-actions Bot mentioned this pull request Oct 19, 2026

[spec-review] Update Safe Outputs conformance checker for recent spec changes #70150

Open

Conversation

Copilot AI commented Oct 18, 2026 • edited by pelikhan Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Behavior

Safety and implementation

Uh oh!

pelikhan commented Oct 18, 2026

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Design Decision Gate 🏗️

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Matt Pocock Skills Reviewer

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

Uh oh!

github-actions Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

Uh oh!

github-actions Bot commented Oct 18, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

Uh oh!

pelikhan commented Oct 19, 2026

Uh oh!

Copilot AI commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Oct 18, 2026 •

edited by pelikhan

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading

github-actions Bot commented Oct 18, 2026 •

edited

Loading