fix: tighten agent governance diff scope

Author: QuantumMisaka

.github/workflows/agent_governance.yml

@@ -22,9 +22,21 @@ jobs:
         id: governance
         run: |
           set +e
+          base_sha="${{ github.event.pull_request.base.sha }}"
+          head_sha="${{ github.event.pull_request.head.sha }}"
+          merge_base="$(git merge-base "$base_sha" "$head_sha")"
+          merge_base_status=$?
+          if [ "$merge_base_status" -ne 0 ]; then
+            {
+              echo "## Agent Governance Check"
+              echo
+              echo "Failed to compute the pull request merge base."
+            } > agent_governance_summary.md
+            exit "$merge_base_status"
+          fi
           python3 tools/03_code_analysis/agent_governance_check.py \
-            --base "${{ github.event.pull_request.base.sha }}" \
-            --head "${{ github.event.pull_request.head.sha }}" \
+            --base "$merge_base" \
+            --head "$head_sha" \
             --event-path "$GITHUB_EVENT_PATH" \
             --format markdown | tee agent_governance_summary.md
           status=${PIPESTATUS[0]}

tools/03_code_analysis/agent_governance_check.py

@@ -150,9 +150,9 @@ def parse_added_lines(diff_text: str) -> List[DiffLine]:
 
 def added_lines(root: Path, args: argparse.Namespace) -> List[DiffLine]:
     if args.staged:
-        output = git(["diff", "--cached", "-U0"], root).stdout
+        output = git(["diff", "--cached", "--ignore-cr-at-eol", "-U0"], root).stdout
     elif args.base and args.head:
-        output = git(["diff", "-U0", args.base, args.head], root).stdout
+        output = git(["diff", "--ignore-cr-at-eol", "-U0", args.base, args.head], root).stdout
     else:
         output = ""
     return parse_added_lines(output)
@@ -436,16 +436,20 @@ def check_input_parameter_docs(
     )
 
 
-def read_pr_body(event_path: Optional[str]) -> str:
+def read_pr_body(event_path: Optional[str]) -> Optional[str]:
     if not event_path:
-        return ""
+        return None
     try:
         with open(event_path, "r", encoding="utf-8") as handle:
             payload = json.load(handle)
     except (OSError, json.JSONDecodeError):
+        return None
+    if "pull_request" not in payload or not isinstance(payload["pull_request"], dict):
+        return None
+    body = payload["pull_request"].get("body")
+    if body is None:
         return ""
-    pr = payload.get("pull_request") or {}
-    return pr.get("body") or ""
+    return str(body)
 
 
 def pr_sections(body: str) -> Dict[str, str]:
@@ -482,8 +486,8 @@ def section_is_placeholder(content: str) -> bool:
     return not meaningful
 
 
-def check_pr_metadata(findings: List[Finding], body: str) -> None:
-    if not body:
+def check_pr_metadata(findings: List[Finding], body: Optional[str]) -> None:
+    if body is None:
         return
     required_sections = [
         "Linked Issue",
@@ -615,18 +619,19 @@ def collect_findings(root: Path, args: argparse.Namespace) -> List[Finding]:
     statuses, changed = changed_paths(root, args)
     lines = added_lines(root, args)
     body = read_pr_body(args.event_path)
+    body_text = body or ""
 
     check_line_endings(findings, root, changed, statuses, args)
     check_global_dependencies(findings, lines)
     check_default_parameters(findings, lines)
     check_hpp_warnings(findings, statuses, lines)
     check_header_include_warnings(findings, lines)
     check_cmake_linkage(findings, statuses, changed)
-    check_input_parameter_docs(findings, changed, statuses, lines, body)
+    check_input_parameter_docs(findings, changed, statuses, lines, body_text)
     check_pr_metadata(findings, body)
-    check_test_evidence_warning(findings, changed, body)
-    check_heterogeneous_test_warning(findings, changed, body)
-    check_documentation_warning(findings, changed, body)
+    check_test_evidence_warning(findings, changed, body_text)
+    check_heterogeneous_test_warning(findings, changed, body_text)
+    check_documentation_warning(findings, changed, body_text)
     return findings
 
 

tools/03_code_analysis/test_agent_governance_check.py

@@ -118,6 +118,31 @@ def test_blocks_default_parameters_added_to_headers(self):
 
         self.assert_blocked_by(result, "No new default parameters")
 
+    def test_ignores_crlf_to_lf_only_changes_for_semantic_added_lines(self):
+        self.write("source/source_base/defaults.h", b"void update_solver(int step = 0);\r\n", mode="wb")
+        self.git("add", ".")
+        self.git("commit", "-m", "add crlf header")
+        base = self.git("rev-parse", "HEAD").stdout.strip()
+        self.write("source/source_base/defaults.h", "void update_solver(int step = 0);\n")
+        head = self.commit_change()
+
+        result = self.run_checker("--base", base, "--head", head)
+
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertNotIn("No new default parameters", result.stdout)
+
+    def test_staged_mode_ignores_crlf_to_lf_only_semantic_added_lines(self):
+        self.write("source/source_base/defaults.h", b"void update_solver(int step = 0);\r\n", mode="wb")
+        self.git("add", ".")
+        self.git("commit", "-m", "add crlf header")
+        self.write("source/source_base/defaults.h", "void update_solver(int step = 0);\n")
+        self.git("add", ".")
+
+        result = self.run_checker("--staged")
+
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertNotIn("No new default parameters", result.stdout)
+
     def test_allows_for_loop_initializer_in_header(self):
         self.write(
             "source/source_base/loop_header.h",
@@ -232,6 +257,33 @@ def test_blocks_unfilled_pr_template_fields_from_event_payload(self):
 
         self.assert_blocked_by(result, "PR metadata completeness")
 
+    def test_blocks_empty_pr_template_from_event_payload(self):
+        for body in ("", None):
+            with self.subTest(body=body):
+                event = self.repo / "event.json"
+                event.write_text(json.dumps({"pull_request": {"body": body}}))
+
+                result = self.run_checker("--event-path", str(event))
+
+                self.assert_blocked_by(result, "PR metadata completeness")
+
+    def test_blocks_missing_pr_body_from_event_payload(self):
+        event = self.repo / "event.json"
+        event.write_text(json.dumps({"pull_request": {}}))
+
+        result = self.run_checker("--event-path", str(event))
+
+        self.assert_blocked_by(result, "PR metadata completeness")
+
+    def test_skips_pr_metadata_when_event_payload_is_not_a_pull_request(self):
+        event = self.repo / "event.json"
+        event.write_text(json.dumps({"workflow_run": {"name": "Agent Governance"}}))
+
+        result = self.run_checker("--event-path", str(event))
+
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertNotIn("PR metadata completeness", result.stdout)
+
     def test_accepts_filled_pr_template_fields_from_event_payload(self):
         event = self.repo / "event.json"
         event.write_text(
@@ -469,6 +521,26 @@ def test_warns_for_new_header_include(self):
 
         self.assert_warns_with_success(result, "Header dependency review")
 
+    def test_merge_base_scoped_comparison_excludes_base_branch_only_changes(self):
+        self.write("source/source_base/api.h", "void update_solver(int step = 0);\n")
+        self.git("add", ".")
+        self.git("commit", "-m", "add legacy default")
+        base_branch = self.git("branch", "--show-current").stdout.strip()
+        merge_base = self.git("rev-parse", "HEAD").stdout.strip()
+        self.git("checkout", "-b", "feature")
+        self.write("docs/feature.md", "feature docs\n")
+        head = self.commit_change()
+        self.git("checkout", base_branch)
+        self.write("source/source_base/api.h", "void update_solver(int step);\n")
+        base_tip = self.commit_change()
+
+        base_tip_result = self.run_checker("--base", base_tip, "--head", head)
+        merge_base_result = self.run_checker("--base", merge_base, "--head", head)
+
+        self.assertIn("No new default parameters", base_tip_result.stdout)
+        self.assertNotIn("No new default parameters", merge_base_result.stdout)
+        self.assertEqual(merge_base_result.returncode, 0, merge_base_result.stdout + merge_base_result.stderr)
+
     def test_blocks_new_heterogeneous_file_without_cmake_linkage(self):
         self.write("source/module_hamilt/kernels/new_kernel.cu", "__global__ void k() {}\n")
         head = self.commit_change()