TT-17163: fix dependency-guard failure on branches with no merge base

[olamilekan000]

Issue

https://tyktech.atlassian.net/browse/TT-17163

Description

This PR resolves a bug in the reusable dependency-guard workflow where the pipeline crashes with fatal: origin/master...HEAD: no merge base on branches with rewritten history, orphan branches, or direct push/release events.

The Issues Addressed

1. Unnecessary Runs on Direct Pushes/Releases:
   • A dependency guard acts as a gatekeeper to prevent unapproved dependency changes from merging. However, on direct push events (e.g., release branch creations or tag pushes), there is no PR interface, meaning there is no way for a reviewer to add a bypass label. Running the guard here causes a permanent pipeline block.
   • This exact bug broke the tyk-analytics-ui pipeline during a direct release branch push (run #25502662240).
2. Crash on legitimate orphan PRs:
   • Legitimate PRs with no common ancestor (merge base) with master would crash when using the three-dot diff (...).

Proposed Changes

1. Restrict Guard to Pull Requests (if: condition):
   • Added github.event.pull_request to the step check so the dependency guard is skipped entirely on direct pushes, schedules, or release dispatches.
2. Two-Dot Diff Fallback:
   • When running on a PR that has no merge base, the workflow now securely falls back to a direct two-dot diff (git diff origin/BASE_REF..HEAD) comparing the trees directly.
   • This covers the entire accumulative state of the branch and safely ensures no commits can bypass the dependency checks.

[probelabs]

This PR fixes a bug in the dependency-guard reusable workflow that caused it to fail on branches without a common merge base with the target branch (e.g., orphan branches, branches with rewritten history). It also prevents the workflow from running on non-pull-request events like direct pushes, which previously caused pipelines to stall indefinitely.

Files Changed Analysis

The change is isolated to the .github/workflows/dependency-guard.yml file, with 7 additions and 2 deletions. The modifications introduce conditional logic to handle different Git history scenarios.

Architecture & Impact Assessment

• What this PR accomplishes: It makes the dependency-guard workflow more robust by preventing crashes on branches with no merge base and avoiding unnecessary runs on direct pushes.
• Key technical changes introduced:
  1. The workflow step is now restricted to run only on pull_request events.
  2. A fallback mechanism is added. If git merge-base fails to find a common ancestor, the script uses a direct two-dot diff (..) instead of a three-dot diff (...) to compare the branch's changes.
• Affected system components: This change impacts all CI pipelines across repositories that utilize this reusable workflow, improving their stability.

graph TD
    A[Start Dependency Check] --> B{Is event a Pull Request?};
    B -- No --> C[Skip Check];
    B -- Yes --> D{Merge base exists?};
    D -- Yes --> E["Use three-dot diff (origin/base...HEAD)"];
    D -- No --> F["Log Warning & Use two-dot diff (origin/base..HEAD)"];
    E --> G[Check for changed dependency files];
    F --> G;
    G --> H{Changes found?};
    H -- Yes --> I[Fail workflow];
    H -- No --> J[Pass];

Loading

Scope Discovery & Context Expansion

The change is self-contained within the workflow definition. Its impact is broad, affecting any project that imports and uses this dependency-guard workflow. The fix is generic and improves the reliability of the dependency check gate for all consumers without requiring changes in their repositories.

Metadata

• Review Effort: 2 / 5
• Primary Label: n/a

---

Powered by Visor from Probelabs

Last updated: 2026-05-25T11:26:08.575Z | Triggered by: pr_opened | Commit: c6bcc5e

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-05-25T11:25:57.690Z | Triggered by: pr_opened | Commit: c6bcc5e

💡 TIP: You can chat with Visor using /visor ask <your question>

[rafalgolarz]

LGTM 👍
Thanks @olamilekan000