From 01e54985736be8f8b1f07374c2e875d304c0b7ac Mon Sep 17 00:00:00 2001
From: alexbelgium <alexandre.pary@gmail.com>
Date: Tue, 21 Jul 2026 21:39:54 +0200
Subject: [PATCH] Derive base SHA from the merge commit's own parent, not the
 event snapshot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

github.event.pull_request.base.sha is fixed at the time the triggering
event fired. In a repo with frequent direct-to-master pushes, master can
advance between that event and job checkout, while the actions/checkout
merge commit (github.sha) is always built against the *current* master
tip. Diffing the stale event SHA against the live merge commit picked up
unrelated upstream commits — observed live on this PR: scrutiny and
scrutiny_fa showed up as "changed" and failed their changelog check, even
though this PR only touches the workflow file.

HEAD^1 is the actual base the checked-out merge commit was built from
(verified: parents are [live master tip, PR head]), so it can't go stale.
---
 .github/workflows/onpr_check-pr.yaml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/onpr_check-pr.yaml b/.github/workflows/onpr_check-pr.yaml
index 86e409031a..bd4ab6a197 100644
--- a/.github/workflows/onpr_check-pr.yaml
+++ b/.github/workflows/onpr_check-pr.yaml
@@ -22,8 +22,12 @@ jobs:
       - name: Find changed addon directories
         id: find_addons
         run: |
-          git fetch origin "${{ github.event.pull_request.base.sha }}"
-          diff_files=$(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
+          # github.event.pull_request.base.sha is a snapshot from event-trigger time and can be
+          # stale if master advances before checkout; HEAD^1 is the actual base this merge
+          # commit was built against, so it's always correct.
+          base_sha=$(git rev-parse HEAD^1)
+          git fetch origin "$base_sha"
+          diff_files=$(git diff --name-only "$base_sha" "${{ github.sha }}")
           changed_config_files=$(printf '%s\n' "$diff_files" | grep -E '^[^/]+/config\.(json|ya?ml)$' || true)
           echo "Changed config files:"
           echo "$changed_config_files"
@@ -33,8 +37,9 @@ jobs:
       - name: Find changelog
         id: changed-files
         run: |
-          git fetch origin "${{ github.event.pull_request.base.sha }}"
-          diff_files=$(git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
+          base_sha=$(git rev-parse HEAD^1)
+          git fetch origin "$base_sha"
+          diff_files=$(git diff --name-only "$base_sha" "${{ github.sha }}")
           changed_changelog_files=$(printf '%s\n' "$diff_files" | grep -iE '^([^/]+/)?changelog\.(md|txt|ya?ml|json)$' || true)
           echo "$changed_changelog_files"
           {