fix(dep-guard): handle branches with no merge base

[bsten-tyk]

Summary

• Add merge-base check before the diff, with fallback to HEAD~1 HEAD comparison for orphan/diverged branches
• Guard against single-commit branches where HEAD~1 does not exist

Why

The workflow crashes with fatal: no merge base on orphan or diverged branches (e.g. release-5.13.0).

TT-17163

[probelabs]

This PR fixes a bug in the dependency-guard workflow that caused it to crash when running on branches without a common ancestor with the base branch (e.g., orphan or diverged release branches).

Files Changed Analysis

• .github/workflows/dependency-guard.yml (+8, -1): The core logic was updated to be more resilient. Instead of directly running git diff, it now first checks for a common ancestor using git merge-base. If one isn't found, it falls back to comparing the last two commits (HEAD~1 vs HEAD), with an additional safeguard for single-commit branches.

Architecture & Impact Assessment

What this PR accomplishes:
This change makes the dependency-guard reusable workflow more robust, preventing CI failures for PRs from branches with divergent histories. This is critical for unblocking CI pipelines in downstream repositories like tyk-analytics-ui and tyk-analytics, particularly for release branches.

Key technical changes introduced:

1. Conditional Diffing: The workflow now uses git merge-base to check if a common ancestor exists before attempting a diff.
2. Fallback Logic: If no merge-base is found, it logs a warning and compares the latest commit against its parent (HEAD~1 HEAD).
3. Edge Case Handling: It includes a check to prevent errors on new branches with only a single commit where HEAD~1 would not exist.

Affected system components:

• The dependency-guard.yml reusable workflow.
• All downstream CI pipelines that invoke this workflow.

New Logic Flow:

flowchart TD
    A[Start] --> B{Merge-base with origin/$BASE_REF exists?};
    B -- Yes --> C[diff against base branch];
    B -- No --> D[Log warning];
    D --> E{"Parent commit (HEAD~1) exists?"};
    E -- Yes --> F[diff against parent commit];
    E -- No --> G["Skip diff (single-commit branch)"];
    C --> H{Dependency files changed?};
    F --> H;
    G --> H;
    H -- Yes --> I[Fail workflow];
    H -- No --> J[Pass workflow];

Loading

Scope Discovery & Context Expansion

This modification is within a reusable GitHub workflow, meaning its impact extends to all repositories that consume it. The fix is crucial for maintaining CI stability across projects, especially those employing release-branching strategies that result in divergent git histories. To fully assess the blast radius, one would search for all repositories in the organization that have a uses: clause pointing to this dependency-guard.yml workflow.

Metadata

• Review Effort: 2 / 5
• Primary Label: bug

---

Powered by Visor from Probelabs

Last updated: 2026-05-08T13:40:50.841Z | Triggered by: pr_updated | Commit: 186b3ea

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟠 Error	.github/workflows/dependency-guard.yml:53-55	The fallback logic for branches without a merge-base does not handle single-commit branches. If a pull request is opened from an orphan branch containing only one commit, the check for a parent commit (`HEAD~1`) will fail, and the `CHANGED` variable will remain empty. This causes the dependency check to be skipped entirely for that commit, potentially allowing un-vetted dependency changes to be merged without the required scrutiny. 💡 Suggestion Implement a final fallback to handle single-commit branches. When `HEAD~1` does not exist, the workflow should compare `HEAD` against Git's well-known empty tree hash (`4b825dc642cb6eb9a060e54bf8d69288fbee4904`) to ensure that the changes introduced in the initial commit are properly analyzed. 🔧 Suggested Fix if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then CHANGED=$(git diff --name-only HEAD~1 HEAD -- "${PATHS[@]}") else echo "::warning title=Dependency Guard::No parent commit found. Falling back to diffing against an empty tree." CHANGED=$(git diff --name-only 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD -- "${PATHS[@]}") fi

✅ Performance Check Passed

No performance issues found – changes LGTM.

Security Issues (1)

Severity	Location	Issue
🟠 Error	.github/workflows/dependency-guard.yml:53-55	The fallback logic for branches without a merge-base does not handle single-commit branches. If a pull request is opened from an orphan branch containing only one commit, the check for a parent commit (`HEAD~1`) will fail, and the `CHANGED` variable will remain empty. This causes the dependency check to be skipped entirely for that commit, potentially allowing un-vetted dependency changes to be merged without the required scrutiny. 💡 Suggestion Implement a final fallback to handle single-commit branches. When `HEAD~1` does not exist, the workflow should compare `HEAD` against Git's well-known empty tree hash (`4b825dc642cb6eb9a060e54bf8d69288fbee4904`) to ensure that the changes introduced in the initial commit are properly analyzed. 🔧 Suggested Fix if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then CHANGED=$(git diff --name-only HEAD~1 HEAD -- "${PATHS[@]}") else echo "::warning title=Dependency Guard::No parent commit found. Falling back to diffing against an empty tree." CHANGED=$(git diff --name-only 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD -- "${PATHS[@]}") fi

\n\n \n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

\n\n

Quality Issues (1)

Severity	Location	Issue
🟠 Error	.github/workflows/dependency-guard.yml:53-55	The workflow fails to check for dependency changes on single-commit branches that have no merge base. When `git rev-parse --verify HEAD~1` fails because there is no parent commit, the `CHANGED` variable is not set. The subsequent check `[ -n "$CHANGED" ]` then evaluates to false, causing the workflow to pass without having checked the files in the single commit. This undermines the purpose of the dependency guard for this edge case. 💡 Suggestion Add an `else` block to handle the case where no parent commit exists. In this scenario, the commit should be compared against an empty tree to correctly identify all added files. 🔧 Suggested Fix if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then CHANGED=$(git diff --name-only HEAD~1 HEAD -- "${PATHS[@]}") else echo "::warning title=Dependency Guard::No parent commit found. Comparing HEAD against empty tree." CHANGED=$(git diff --name-only $(git hash-object -t tree /dev/null) HEAD -- "${PATHS[@]}") fi

---

Powered by Visor from Probelabs

Last updated: 2026-05-08T13:40:49.384Z | Triggered by: pr_updated | Commit: 186b3ea

💡 TIP: You can chat with Visor using /visor ask <your question>

[olamilekan000]

@bsten-tyk I opened another PR to fix this issue #131. Can this be closed?