Incremental SAST - #8
Open
endor-lmoreno wants to merge 12 commits into
Open
Conversation
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
2 times, most recently
from
February 16, 2026 10:01
e25b17d to
9625afa
Compare
Update the endorlabs GitHub Actions workflow to perform a shallow checkout. Adds `fetch-depth: 1` and `fetch-tags: false` to the actions/checkout@v3 step (with explanatory comments) so only the current commit and PR branch are fetched, reducing checkout time and ensuring the base branch and tags aren't available locally.
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
2 times, most recently
from
February 16, 2026 10:33
8ff2b5b to
e7a35d1
Compare
Update .github/workflows/endorlabs.yml to comment out the shallow-checkout options and add a step that deletes local/remotes refs and any tag for the 'incremental_sast' branch. This explicitly removes the base branch reference (if present) during the job to simulate a missing base branch for tooling that relies on its absence; deletion commands are no-ops if refs/tags don't exist.
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
from
February 16, 2026 10:36
e7a35d1 to
64ba172
Compare
Upgrade actions/checkout to v4 and force a shallow checkout of the PR head (fetch-depth: 1, ref: PR head sha). Add comprehensive git debug steps and a non-failing baseline fetch using --shallow-since to reproduce/observe cases where the base branch history is missing (ensureRefsAvailable scenario). New checks include repo status, HEAD log, remotes, branch refs, show-ref for the baseline, merge-base attempt, recent logs, and detection of .git/shallow. Also add a brief echo before running the Endor Labs PR incremental scan. The fetches deliberately do not fail (|| true) to let downstream scan behavior be observed.
Replace the previous debug + shallow-fetch step with a scripted setup that forces the workflow to hit the ensureRefsAvailable fetch path. The new step obtains the base branch hash via git ls-remote, creates a refs/remotes/origin/<base> ref pointing to that hash (without fetching the commit object), verifies the ref, and asserts that the commit object is missing so downstream logic will attempt a shallow fetch. Also adds explanatory logging before the scan run and removes the previous time-based SHALLOW_DAYS shallow-fetch attempt. This makes the workflow deterministically reproduce the case where the baseline tip is not available locally and the job must fetch from origin.
Tidy and enhance the Endor Labs GitHub Actions workflow: fix branch array spacing, normalize step indentation, and revamp the setup step used to trigger the ensureRefsAvailable condition (line 274). The setup step now adds a SHALLOW_DAYS variable (default 30), will unshallow the repo if needed, and uses git fetch --shallow-since to create a branch ref without pulling older commit objects (replacing the previous update-ref approach). Additional checks and clearer logging were added to detect whether the commit object exists locally and to explain expected behavior when the ref exists but the object is missing. The Java build/download/run steps remain but received minor formatting/quoting normalization.
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
3 times, most recently
from
February 17, 2026 15:27
e9b40ee to
c917008
Compare
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
3 times, most recently
from
February 17, 2026 16:43
e6509b2 to
8a24345
Compare
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
from
February 17, 2026 16:47
8a24345 to
baa8021
Compare
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
2 times, most recently
from
February 17, 2026 17:16
44426d4 to
e71eb0a
Compare
endor-lmoreno
force-pushed
the
incremental_sast_update
branch
from
March 2, 2026 07:51
e71eb0a to
eed275d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.