fix: resolve the pull request head from the event, skip authors without it

pull_request.head.sha names the branch tip for pull_request and
pull_request_target alike, whatever was checked out, so the author
checks read it first. HEAD^2 stays as the fallback on a pull_request
checkout only: on pull_request_target HEAD is the base branch, and its
second parent, when it has one, belongs to some unrelated merge.

When neither resolves, the author scopes are reported as skipped
instead of being run on HEAD, whose author on a pull request is
GitHub's merge commit or the base branch, never the contributor.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xYa7m3qup5wyN5MaXFgf6

Author: shenxianpeng

main.py

@@ -215,23 +215,87 @@ def warn_shallow_checkout(problem: str, consequence: str) -> None:
     print(f"::warning title=commit-check::{_annotation_escape(text)}")
 
 
-def pr_head_rev() -> str | None:
-    """Return ``HEAD^2`` when it resolves, ``None`` on a shallow clone.
+def get_pr_head_sha() -> str | None:
+    """The pull request's head commit, from the event payload."""
+    if not is_pr_event():
+        return None
+    event_path = os.getenv("GITHUB_EVENT_PATH")
+    if not event_path:
+        return None
+    try:
+        with open(event_path, "r", encoding="utf-8") as f:
+            event = json.load(f)
+        return event.get("pull_request", {}).get("head", {}).get("sha") or None
+    except Exception as e:
+        print(f"::warning::Failed to read PR head from event: {e}", file=sys.stderr)
+        return None
 
-    With ``fetch-depth: 1`` the merge commit's parents are not fetched and
-    ``git rev-parse HEAD^2`` fails, so the caller has to settle for HEAD.
-    """
+
+def _rev_resolves(rev: str) -> bool:
+    """Whether ``rev`` names a commit the clone actually has."""
     try:
         result = subprocess.run(
-            ["git", "rev-parse", "--verify", "--quiet", PR_HEAD_REV],
+            ["git", "rev-parse", "--verify", "--quiet", f"{rev}^{{commit}}"],
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             encoding="utf-8",
             check=False,
         )
     except OSError:
-        return None
-    return PR_HEAD_REV if result.returncode == 0 else None
+        return False
+    return result.returncode == 0
+
+
+def pr_head_rev() -> str | None:
+    """The commit whose recorded author the PR's author checks read.
+
+    First choice is ``pull_request.head.sha`` from the event payload: it
+    names the branch tip for ``pull_request`` and ``pull_request_target``
+    alike, whatever was checked out, as long as the clone has it. Failing
+    that, ``HEAD^2`` on a ``pull_request`` checkout, where HEAD is the
+    merge ref and its second parent is that same tip. Never ``HEAD^2`` on
+    ``pull_request_target``: there HEAD is the base branch, so ``HEAD^2``
+    is nothing, or the parent of some unrelated merge on it.
+
+    ``None`` when the clone is too shallow to hold either.
+    """
+    sha = get_pr_head_sha()
+    if sha and _rev_resolves(sha):
+        return sha
+    if os.getenv("GITHUB_EVENT_NAME") == "pull_request" and _rev_resolves(PR_HEAD_REV):
+        return PR_HEAD_REV
+    return None
+
+
+#: The rule each author check runs, for a scope that had to be skipped.
+AUTHOR_RULES = {
+    "--author-name": ("CC101", "author_name"),
+    "--author-email": ("CC102", "author_email"),
+}
+
+
+def skipped_author_scope(flag: str) -> ScopeResult:
+    """A scope recording that an author check could not run at all.
+
+    Reported as ``skip``, never as a pass: nothing was validated, and the
+    one commit the clone does hold (HEAD) has the wrong author for a pull
+    request, GitHub's merge commit or the base branch.
+    """
+    rule_id, check = AUTHOR_RULES[flag]
+    return ScopeResult(
+        label=CHECK_LABELS[flag],
+        checks=[
+            {
+                "rule_id": rule_id,
+                "check": check,
+                "status": "skip",
+                "value": "",
+                "error": "",
+                "suggest": "",
+                "docs_url": "",
+            }
+        ],
+    )
 
 
 def get_pr_title() -> str | None:
@@ -441,11 +505,18 @@ def run_commit_check() -> tuple[int, list[ScopeResult]]:
     if is_pr_event() and any(flag in AUTHOR_FLAGS for flag in args):
         rev = pr_head_rev()
         if rev is None:
+            # HEAD's author is GitHub's merge commit on a pull_request
+            # checkout and the base branch on pull_request_target: checking
+            # it would grade the wrong person either way. Say so, and skip.
             warn_shallow_checkout(
-                f"Could not resolve {PR_HEAD_REV} for the author checks",
-                "HEAD's author was checked instead, which on a pull request "
-                "is GitHub's merge commit",
+                "Could not resolve the pull request's head commit for the "
+                "author checks",
+                "they were skipped",
             )
+            for flag in args:
+                if flag in AUTHOR_FLAGS:
+                    results.append(skipped_author_scope(flag))
+            args = [a for a in args if a not in AUTHOR_FLAGS]
     results.extend(run_other_checks(args, rev=rev))
 
     exit_code = exit_code_for(results)

main_test.py

@@ -643,16 +643,16 @@ def test_push_without_pr_commits_does_not_warn(self):
         self.assertNotIn("::warning", output)
 
     @staticmethod
-    def _fake_git_and_cli(head2_resolves: bool):
+    def _fake_git_and_cli(resolves: bool):
         """subprocess.run stand-in: answers rev-parse and the CLI alike."""
         commands: list[list[str]] = []
 
         def run(command, **_kwargs):
             commands.append(command)
             if command[:2] == ["git", "rev-parse"]:
                 return MagicMock(
-                    returncode=0 if head2_resolves else 1,
-                    stdout="abc123\n" if head2_resolves else "",
+                    returncode=0 if resolves else 1,
+                    stdout="abc123\n" if resolves else "",
                 )
             check = command[3].lstrip("-").replace("-", "_")
             return MagicMock(returncode=0, stdout=json_output(make_check(check)))
@@ -661,21 +661,24 @@ def run(command, **_kwargs):
 
     def test_pr_author_checks_read_the_branch_tip(self):
         """On refs/pull/N/merge HEAD's author is GitHub, not the contributor."""
-        run, commands = self._fake_git_and_cli(head2_resolves=True)
+        run, commands = self._fake_git_and_cli(resolves=True)
         with (
             patch("main.MESSAGE_ENABLED", False),
             patch("main.BRANCH_ENABLED", True),
             patch("main.AUTHOR_NAME_ENABLED", True),
             patch("main.AUTHOR_EMAIL_ENABLED", True),
-            patch("main.is_pr_event", return_value=True),
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_pr_head_sha", return_value=None),
             patch("main.subprocess.run", side_effect=run),
         ):
             rc, results, output = self._run_capturing_stdout()
         self.assertEqual(rc, 0)
         self.assertEqual(
             [s.label for s in results], ["Branch", "Author name", "Author email"]
         )
-        self.assertIn(["git", "rev-parse", "--verify", "--quiet", "HEAD^2"], commands)
+        self.assertIn(
+            ["git", "rev-parse", "--verify", "--quiet", "HEAD^2^{commit}"], commands
+        )
         self.assertIn(
             ["commit-check", "--format", "json", "--author-name", "--rev", "HEAD^2"],
             commands,
@@ -688,28 +691,104 @@ def test_pr_author_checks_read_the_branch_tip(self):
         self.assertIn(["commit-check", "--format", "json", "--branch"], commands)
         self.assertNotIn("::warning", output)
 
-    def test_pr_author_checks_fall_back_to_head_on_shallow_clone(self):
-        run, commands = self._fake_git_and_cli(head2_resolves=False)
+    def test_pr_author_checks_prefer_the_payload_head_sha(self):
+        """pull_request.head.sha names the tip for either PR event type."""
+        run, commands = self._fake_git_and_cli(resolves=True)
         with (
             patch("main.MESSAGE_ENABLED", False),
             patch("main.BRANCH_ENABLED", False),
             patch("main.AUTHOR_NAME_ENABLED", True),
             patch("main.AUTHOR_EMAIL_ENABLED", False),
-            patch("main.is_pr_event", return_value=True),
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request_target"}),
+            patch("main.get_pr_head_sha", return_value="deadbeefcafe"),
             patch("main.subprocess.run", side_effect=run),
         ):
             rc, results, output = self._run_capturing_stdout()
         self.assertEqual(rc, 0)
-        self.assertIn(["commit-check", "--format", "json", "--author-name"], commands)
-        self.assertFalse([c for c in commands if "--rev" in c], commands)
+        self.assertEqual([s.status for s in results], ["pass"])
+        self.assertIn(
+            ["git", "rev-parse", "--verify", "--quiet", "deadbeefcafe^{commit}"],
+            commands,
+        )
+        self.assertIn(
+            [
+                "commit-check",
+                "--format",
+                "json",
+                "--author-name",
+                "--rev",
+                "deadbeefcafe",
+            ],
+            commands,
+        )
+        self.assertNotIn("::warning", output)
+
+    def test_pr_author_checks_are_skipped_on_a_shallow_clone(self):
+        """HEAD's author is GitHub's merge commit: skip rather than grade it."""
+        run, commands = self._fake_git_and_cli(resolves=False)
+        with (
+            patch("main.MESSAGE_ENABLED", False),
+            patch("main.BRANCH_ENABLED", True),
+            patch("main.AUTHOR_NAME_ENABLED", True),
+            patch("main.AUTHOR_EMAIL_ENABLED", True),
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch("main.subprocess.run", side_effect=run),
+        ):
+            rc, results, output = self._run_capturing_stdout()
+        self.assertEqual(rc, 0)
+        self.assertEqual(
+            [(s.label, s.status) for s in results],
+            [("Author name", "skip"), ("Author email", "skip"), ("Branch", "pass")],
+        )
+        self.assertEqual(
+            results[0].checks,
+            [
+                {
+                    "rule_id": "CC101",
+                    "check": "author_name",
+                    "status": "skip",
+                    "value": "",
+                    "error": "",
+                    "suggest": "",
+                    "docs_url": "",
+                }
+            ],
+        )
+        self.assertEqual(results[1].checks[0]["rule_id"], "CC102")
+        self.assertFalse([c for c in commands if "--author-name" in c], commands)
+        self.assertFalse([c for c in commands if "--author-email" in c], commands)
+        self.assertIn(["commit-check", "--format", "json", "--branch"], commands)
         warning = [ln for ln in output.splitlines() if ln.startswith("::warning")]
         self.assertEqual(len(warning), 1, output)
         self.assertTrue(warning[0].startswith("::warning title=commit-check::"))
-        self.assertIn("Could not resolve HEAD^2", warning[0])
+        self.assertIn("Could not resolve the pull request's head commit", warning[0])
         self.assertIn("is actions/checkout using fetch-depth: 0?", warning[0])
+        self.assertIn("they were skipped", warning[0])
+
+    def test_pull_request_target_never_uses_head2(self):
+        """On pull_request_target HEAD is the base branch; HEAD^2 is unrelated."""
+        run, commands = self._fake_git_and_cli(resolves=True)
+        with (
+            patch("main.MESSAGE_ENABLED", False),
+            patch("main.BRANCH_ENABLED", False),
+            patch("main.AUTHOR_NAME_ENABLED", True),
+            patch("main.AUTHOR_EMAIL_ENABLED", False),
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request_target"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch("main.subprocess.run", side_effect=run),
+        ):
+            rc, results, output = self._run_capturing_stdout()
+        self.assertEqual(rc, 0)
+        self.assertEqual(
+            [(s.label, s.status) for s in results], [("Author name", "skip")]
+        )
+        self.assertFalse([c for c in commands if "HEAD^2^{commit}" in c], commands)
+        self.assertFalse([c for c in commands if c[0] == "commit-check"], commands)
+        self.assertIn("::warning title=commit-check::", output)
 
     def test_push_author_checks_never_pass_rev(self):
-        run, commands = self._fake_git_and_cli(head2_resolves=True)
+        run, commands = self._fake_git_and_cli(resolves=True)
         with (
             patch("main.MESSAGE_ENABLED", False),
             patch("main.BRANCH_ENABLED", False),
@@ -725,25 +804,101 @@ def test_push_author_checks_never_pass_rev(self):
 
 
 class TestPrHeadRev(unittest.TestCase):
-    def test_resolving_head2_returns_the_revision(self):
-        with patch(
-            "main.subprocess.run", return_value=MagicMock(returncode=0)
-        ) as mock_run:
+    def test_payload_head_sha_wins_when_the_clone_has_it(self):
+        with (
+            patch("main.get_pr_head_sha", return_value="abc123"),
+            patch(
+                "main.subprocess.run", return_value=MagicMock(returncode=0)
+            ) as mock_run,
+        ):
+            self.assertEqual(main.pr_head_rev(), "abc123")
+        self.assertEqual(
+            mock_run.call_args[0][0],
+            ["git", "rev-parse", "--verify", "--quiet", "abc123^{commit}"],
+        )
+
+    def test_pull_request_falls_back_to_head2(self):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch(
+                "main.subprocess.run", return_value=MagicMock(returncode=0)
+            ) as mock_run,
+        ):
             self.assertEqual(main.pr_head_rev(), "HEAD^2")
         self.assertEqual(
             mock_run.call_args[0][0],
-            ["git", "rev-parse", "--verify", "--quiet", "HEAD^2"],
+            ["git", "rev-parse", "--verify", "--quiet", "HEAD^2^{commit}"],
         )
 
+    def test_pull_request_target_does_not_fall_back_to_head2(self):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request_target"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch(
+                "main.subprocess.run", return_value=MagicMock(returncode=0)
+            ) as mock_run,
+        ):
+            self.assertIsNone(main.pr_head_rev())
+        mock_run.assert_not_called()
+
+    def test_unfetched_payload_sha_on_pull_request_target_returns_none(self):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request_target"}),
+            patch("main.get_pr_head_sha", return_value="abc123"),
+            patch("main.subprocess.run", return_value=MagicMock(returncode=1)),
+        ):
+            self.assertIsNone(main.pr_head_rev())
+
     def test_shallow_clone_returns_none(self):
-        with patch("main.subprocess.run", return_value=MagicMock(returncode=1)):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch("main.subprocess.run", return_value=MagicMock(returncode=1)),
+        ):
             self.assertIsNone(main.pr_head_rev())
 
     def test_missing_git_returns_none(self):
-        with patch("main.subprocess.run", side_effect=OSError("no git")):
+        with (
+            patch.dict(os.environ, {"GITHUB_EVENT_NAME": "pull_request"}),
+            patch("main.get_pr_head_sha", return_value=None),
+            patch("main.subprocess.run", side_effect=OSError("no git")),
+        ):
             self.assertIsNone(main.pr_head_rev())
 
 
+class TestGetPrHeadSha(unittest.TestCase):
+    def test_reads_the_head_sha_from_the_event(self):
+        with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f:
+            json.dump({"pull_request": {"head": {"sha": "abc123"}}}, f)
+            event_path = f.name
+        try:
+            with patch.dict(
+                os.environ,
+                {
+                    "GITHUB_EVENT_NAME": "pull_request_target",
+                    "GITHUB_EVENT_PATH": event_path,
+                },
+            ):
+                self.assertEqual(main.get_pr_head_sha(), "abc123")
+        finally:
+            os.unlink(event_path)
+
+    def test_not_a_pr_event_returns_none(self):
+        with patch.dict(os.environ, {"GITHUB_EVENT_NAME": "push"}):
+            self.assertIsNone(main.get_pr_head_sha())
+
+    def test_unreadable_event_returns_none(self):
+        with patch.dict(
+            os.environ,
+            {
+                "GITHUB_EVENT_NAME": "pull_request",
+                "GITHUB_EVENT_PATH": "/nonexistent.json",
+            },
+        ):
+            self.assertIsNone(main.get_pr_head_sha())
+
+
 class TestCommitCheckVersionPin(unittest.TestCase):
     """The warn rendering is inert against an engine that never emits it.