Commit `9a2a62e575`

9a2a62e575135a9a70e2284c03d65b6d873c9e90

parent: 00033f022f

Verified · cmc ci/build: success ci/sonar: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-05 06:34 UTC

ci: derive a diff base from the merge base on a branch's first push

Path filters (#169) fell back to running every job whenever old was
empty or all-zero, which is what a new branch's first push always
sends. Since branch-then-merge-request is the normal workflow, that
made filters apply only to a second push on an already-existing
branch — not the shape most changes have.

queueJobs now falls back to the merge base of the default branch and
the new sha when there is no old sha, computed at most once per call
and only when some job declares paths or paths-ignore. Still fails
open when the merge base can't be computed (unrelated histories), or
equals the new sha itself (a fresh repository's first push, which
moves the default branch with nothing to diff against).

QueueMRBuilds keeps its existing no-fallback, fail-open behavior:
require_checks refuses a merge with no statuses at all, and filtering
an MR head down to zero jobs would make it unmergeable rather than
just unfiltered (#172, not fixed here).

Closes #171

Layout: unified · split

e2e/cipaths_test.go +56

	@@ -62,3 +62,59 @@ func TestCIPaths(t *testing.T) {
62	t.Fatalf("src push did not queue the unit job:\n%s", out)	62	t.Fatalf("src push did not queue the unit job:\n%s", out)
63	}	63	}
64	}	64	}
		65
		66	// A branch's first push has no old sha, but path filters must still
		67	// apply: the normal workflow here is branch, commit, open an MR, and
		68	// that first push is always a new branch. Without a merge-base fallback,
		69	// a docs-only branch queues the full suite anyway (#171).
		70	func TestCIPathsNewBranch(t *testing.T) {
		71	inst := startInstance(t)
		72	aliceKey := inst.newKey(t, "alice")
		73	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
		74
		75	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "create", "alice/app"); code != 0 {
		76	t.Fatalf("repo create: %s", errOut)
		77	}
		78	work := t.TempDir()
		79	env := inst.gitEnv(aliceKey)
		80	mustGit(t, work, env, "clone", inst.sshURL("alice/app"), "w")
		81	dir := filepath.Join(work, "w")
		82	os.MkdirAll(filepath.Join(dir, ".gitbay"), 0o755)
		83	os.MkdirAll(filepath.Join(dir, "src"), 0o755)
		84	os.MkdirAll(filepath.Join(dir, "docs"), 0o755)
		85	os.WriteFile(filepath.Join(dir, ".gitbay", "ci.yml"), []byte(
		86	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo fine\n"), 0o644)
		87	os.WriteFile(filepath.Join(dir, "src", "x.go"), []byte("package x\n"), 0o644)
		88	os.WriteFile(filepath.Join(dir, "docs", "x.md"), []byte("# x\n"), 0o644)
		89	mustGit(t, dir, env, "checkout", "-q", "-b", "main")
		90	mustGit(t, dir, env, "add", ".")
		91	mustGit(t, dir, env, "commit", "-q", "-m", "base")
		92	mustGit(t, dir, env, "push", "-q", "origin", "main")
		93	before := strings.Count(inst.buildList(t, aliceKey), "\n")
		94
		95	// A brand-new branch whose only commit touches an ignored path: the
		96	// filter must apply on this, its first push, not just on later ones.
		97	mustGit(t, dir, env, "checkout", "-q", "-b", "docs-branch")
		98	os.WriteFile(filepath.Join(dir, "docs", "x.md"), []byte("# x changed\n"), 0o644)
		99	mustGit(t, dir, env, "add", ".")
		100	mustGit(t, dir, env, "commit", "-q", "-m", "docs only")
		101	mustGit(t, dir, env, "push", "-q", "origin", "docs-branch")
		102	if out := inst.buildList(t, aliceKey); strings.Count(out, "\n") != before {
		103	t.Fatalf("new branch's docs-only push queued a build:\n%s", out)
		104	}
		105
		106	// A brand-new branch touching a matched path still queues, on its
		107	// first push.
		108	mustGit(t, dir, env, "checkout", "-q", "-b", "src-branch")
		109	os.WriteFile(filepath.Join(dir, "src", "x.go"), []byte("package x\n\nvar y int\n"), 0o644)
		110	mustGit(t, dir, env, "add", ".")
		111	mustGit(t, dir, env, "commit", "-q", "-m", "src change")
		112	mustGit(t, dir, env, "push", "-q", "origin", "src-branch")
		113	out := inst.buildList(t, aliceKey)
		114	if strings.Count(out, "\n") != before+1 {
		115	t.Fatalf("new branch's src push did not queue a build:\n%s", out)
		116	}
		117	if !strings.Contains(out, "unit\tpending") {
		118	t.Fatalf("new branch's src push did not queue the unit job:\n%s", out)
		119	}
		120	}

internal/control/build.go +29 −9

 // the merge path for a merge, which updates the ref directly and so never
 // reaches a hook. old is the branch's sha before this update, the diff
 // base a job's path filters run against; a new branch has no prior
-// commit and sends old as empty or all zeros, either of which cannot be
+// commit and sends old as empty or all zeros. queueJobs falls back to
-// diffed and runs every job.
+// the merge base with the default branch in that case, so a filter
+// still applies to a branch's first push — the shape most changes have,
+// since branch-then-MR is the normal workflow here.
 func QueueBranchBuilds(
 	st *store.Store, root, siteURL string,
 	repo store.Repo, userID int64, branch, old, sha string, now time.Time,
 ) {
-	queueJobs(st, root, siteURL, repo, userID, branch, old, sha, now, true, branch == repo.DefaultBranch)
+	queueJobs(st, root, siteURL, repo, userID, branch, old, sha, now, true, branch == repo.DefaultBranch, true)
 }
 // QueueMRBuilds queues the push jobs for a merge request head fetched
 	st *store.Store, root, siteURL string,
 	repo store.Repo, userID, n int64, sha string,
 ) {
-	// No old sha: fails open and runs every job, matching today's
+	// No old sha, and unlike QueueBranchBuilds, no merge-base fallback
-	// behaviour for a merge request head.
+	// either: this deliberately keeps failing open and running every
-	queueJobs(st, root, siteURL, repo, userID, mrHeadRef(n), "", sha, time.Now(), false, false)
+	// job. require_checks refuses a merge when an MR head has no
+	// statuses at all (mr.go), so filtering a head down to zero jobs
+	// would make it unmergeable rather than just unfiltered (#172).
+	queueJobs(st, root, siteURL, repo, userID, mrHeadRef(n), "", sha, time.Now(), false, false, false)
 }
 func queueJobs(
 	st *store.Store, root, siteURL string,
 	repo store.Repo, userID int64, ref, old, sha string, now time.Time,
-	trusted, syncSchedules bool,
+	trusted, syncSchedules, deriveMergeBase bool,
 ) {
 	dir := RepoDir(root, repo.OwnerName, repo.Name)
 	raw, err := gitutil.ReadBlob(dir, sha, ci.ConfigPath, 1<<16)
 	// base does not exist or the diff itself fails, filtered stays
 	// false and every job runs: a filter that cannot be evaluated must
 	// not silently skip CI.
+	//
+	// A branch's first push has no old sha, but a diff base still
+	// exists: the merge base with the default branch. Without deriving
+	// one, every job runs on every new branch, and since branch-then-MR
+	// is the normal workflow, that is the push path filters matter most
+	// for. The merge base of the default branch's tip with itself is
+	// the tip, carrying no diff — that covers the default branch's own
+	// first push on a fresh repository, and must fail open rather than
+	// read as "nothing changed".
 	filtered := false
 	var changed []string
 	for _, j := range jobs {
 		if len(j.Paths) == 0 && len(j.PathsIgnore) == 0 {
 			continue
 		}
-		if ci.HasDiffBase(old) {
+		diffOld := old
-			if files, err := gitutil.DiffFiles(dir, old, sha); err == nil {
+		if !ci.HasDiffBase(diffOld) && deriveMergeBase {
+			if base, err := gitutil.MergeBase(dir, "refs/heads/"+repo.DefaultBranch, sha); err == nil && base != sha {
+				diffOld = base
+			}
+		}
+		if ci.HasDiffBase(diffOld) {
+			if files, err := gitutil.DiffFiles(dir, diffOld, sha); err == nil {
 				changed, filtered = files, true
 			}
 		}

internal/control/build_test.go +270 −20

	@@ -11,15 +11,42 @@ import (
11	"gitbay.org/gitbay/internal/store"	11	"gitbay.org/gitbay/internal/store"
12	)	12	)
13		13
14	// A DiffFiles failure must not turn into a silent skip: when the old sha	14	const testZeroSHA = "0000000000000000000000000000000000000000"
15	// on record cannot be diffed against, every job runs regardless of what	15
16	// it names in paths, the same as when there is no diff base at all.	16	// gitTestEnv sets up an isolated git identity so tests never touch a
17	func TestQueueBranchBuildsFailsOpenOnDiffFailure(t *testing.T) {	17	// developer's real config.
		18	func gitTestEnv() []string {
		19	return append(os.Environ(),
		20	"GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null",
		21	"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.test",
		22	"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.test")
		23	}
		24
		25	func gitRunner(t *testing.T) func(dir string, args ...string) string {
		26	t.Helper()
		27	env := gitTestEnv()
		28	return func(dir string, args ...string) string {
		29	t.Helper()
		30	cmd := exec.Command("git", args...)
		31	cmd.Dir = dir
		32	cmd.Env = env
		33	out, err := cmd.CombinedOutput()
		34	if err != nil {
		35	t.Fatalf("git %v: %v\n%s", args, err, out)
		36	}
		37	return string(out)
		38	}
		39	}
		40
		41	// newQueueTestRepo returns a store with one public repo (default branch
		42	// "main", matching the schema default) and the uid to queue builds as.
		43	func newQueueTestRepo(t testing.T) (store.Store, store.Repo, int64) {
		44	t.Helper()
18	st, err := store.Open(":memory:")	45	st, err := store.Open(":memory:")
19	if err != nil {	46	if err != nil {
20	t.Fatal(err)	47	t.Fatal(err)
21	}	48	}
22	defer st.Close()	49	t.Cleanup(func() { st.Close() })
23	if err := st.MigrateUp(); err != nil {	50	if err := st.MigrateUp(); err != nil {
24	t.Fatal(err)	51	t.Fatal(err)
25	}	52	}
	@@ -35,23 +62,17 @@ func TestQueueBranchBuildsFailsOpenOnDiffFailure(t *testing.T) {
35	if err != nil {	62	if err != nil {
36	t.Fatal(err)	63	t.Fatal(err)
37	}	64	}
		65	return st, repo, uid
		66	}
		67
		68	// A DiffFiles failure must not turn into a silent skip: when the old sha
		69	// on record cannot be diffed against, every job runs regardless of what
		70	// it names in paths, the same as when there is no diff base at all.
		71	func TestQueueBranchBuildsFailsOpenOnDiffFailure(t *testing.T) {
		72	st, repo, uid := newQueueTestRepo(t)
		73	git := gitRunner(t)
38		74
39	root := t.TempDir()	75	root := t.TempDir()
40	env := append(os.Environ(),
41	"GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null",
42	"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.test",
43	"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.test")
44	git := func(dir string, args ...string) string {
45	t.Helper()
46	cmd := exec.Command("git", args...)
47	cmd.Dir = dir
48	cmd.Env = env
49	out, err := cmd.CombinedOutput()
50	if err != nil {
51	t.Fatalf("git %v: %v\n%s", args, err, out)
52	}
53	return string(out)
54	}
55		76
56	// A job whose paths would exclude a docs-only change, so the test	77	// A job whose paths would exclude a docs-only change, so the test
57	// proves something: without fail-open, the diff failure would leave	78	// proves something: without fail-open, the diff failure would leave
	@@ -89,3 +110,232 @@ func TestQueueBranchBuildsFailsOpenOnDiffFailure(t *testing.T) {
89	t.Fatalf("queued build wrong: %+v", builds[0])	110	t.Fatalf("queued build wrong: %+v", builds[0])
90	}	111	}
91	}	112	}
		113
		114	// A new branch's first push carries no old sha, but a diff base still
		115	// exists: the merge base with the default branch. A push whose commits
		116	// only touch paths a job ignores must not queue that job, or path
		117	// filters never do anything on the ordinary branch-then-MR workflow.
		118	func TestQueueBranchBuildsNewBranchIgnoredPathSkips(t *testing.T) {
		119	st, repo, uid := newQueueTestRepo(t)
		120	git := gitRunner(t)
		121	root := t.TempDir()
		122
		123	src := filepath.Join(root, "src")
		124	os.MkdirAll(filepath.Join(src, ".gitbay"), 0o755)
		125	os.MkdirAll(filepath.Join(src, "docs"), 0o755)
		126	os.WriteFile(filepath.Join(src, ".gitbay", "ci.yml"), []byte(
		127	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo hi\n"), 0o644)
		128	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x\n"), 0o644)
		129	git(root, "init", "-q", "-b", "main", "src")
		130	git(src, "add", ".")
		131	git(src, "commit", "-q", "-m", "base")
		132
		133	git(src, "checkout", "-q", "-b", "feature")
		134	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x changed\n"), 0o644)
		135	git(src, "add", ".")
		136	git(src, "commit", "-q", "-m", "docs only")
		137	featureSHA := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		138
		139	dir := RepoDir(root, repo.OwnerName, repo.Name)
		140	os.MkdirAll(filepath.Dir(dir), 0o755)
		141	git(root, "clone", "-q", "--bare", src, dir)
		142
		143	QueueBranchBuilds(st, root, "https://x.test", repo, uid, "feature", testZeroSHA, featureSHA, time.Now())
		144
		145	builds, err := st.ListBuilds(repo.ID, 10)
		146	if err != nil {
		147	t.Fatal(err)
		148	}
		149	if len(builds) != 0 {
		150	t.Fatalf("docs-only push on a new branch queued a build: %+v", builds)
		151	}
		152	}
		153
		154	// The same new-branch push, but touching a path the job cares about:
		155	// the merge-base diff must still let it through.
		156	func TestQueueBranchBuildsNewBranchMatchedPathQueues(t *testing.T) {
		157	st, repo, uid := newQueueTestRepo(t)
		158	git := gitRunner(t)
		159	root := t.TempDir()
		160
		161	src := filepath.Join(root, "src")
		162	os.MkdirAll(filepath.Join(src, ".gitbay"), 0o755)
		163	os.MkdirAll(filepath.Join(src, "src"), 0o755)
		164	os.WriteFile(filepath.Join(src, ".gitbay", "ci.yml"), []byte(
		165	"jobs:\n unit:\n paths:\n - src/**\n steps:\n - echo hi\n"), 0o644)
		166	os.WriteFile(filepath.Join(src, "src", "x.go"), []byte("package x\n"), 0o644)
		167	git(root, "init", "-q", "-b", "main", "src")
		168	git(src, "add", ".")
		169	git(src, "commit", "-q", "-m", "base")
		170
		171	git(src, "checkout", "-q", "-b", "feature")
		172	os.WriteFile(filepath.Join(src, "src", "x.go"), []byte("package x\n\nvar y int\n"), 0o644)
		173	git(src, "add", ".")
		174	git(src, "commit", "-q", "-m", "src change")
		175	featureSHA := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		176
		177	dir := RepoDir(root, repo.OwnerName, repo.Name)
		178	os.MkdirAll(filepath.Dir(dir), 0o755)
		179	git(root, "clone", "-q", "--bare", src, dir)
		180
		181	QueueBranchBuilds(st, root, "https://x.test", repo, uid, "feature", testZeroSHA, featureSHA, time.Now())
		182
		183	builds, err := st.ListBuilds(repo.ID, 10)
		184	if err != nil \|\| len(builds) != 1 {
		185	t.Fatalf("builds after queue: %v %v", builds, err)
		186	}
		187	if builds[0].Job != "unit" \|\| builds[0].SHA != featureSHA {
		188	t.Fatalf("queued build wrong: %+v", builds[0])
		189	}
		190	}
		191
		192	// When the new branch shares no history with the default branch, the
		193	// merge base cannot be computed. That must fail open, same as any other
		194	// diff base that cannot be evaluated.
		195	func TestQueueBranchBuildsNewBranchFailsOpenWithoutMergeBase(t *testing.T) {
		196	st, repo, uid := newQueueTestRepo(t)
		197	git := gitRunner(t)
		198	root := t.TempDir()
		199
		200	dir := RepoDir(root, repo.OwnerName, repo.Name)
		201	os.MkdirAll(filepath.Dir(dir), 0o755)
		202	git(root, "init", "-q", "--bare", dir)
		203
		204	mainSrc := filepath.Join(root, "main-src")
		205	os.MkdirAll(filepath.Join(mainSrc, ".gitbay"), 0o755)
		206	os.WriteFile(filepath.Join(mainSrc, ".gitbay", "ci.yml"), []byte(
		207	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo hi\n"), 0o644)
		208	git(root, "init", "-q", "-b", "main", "main-src")
		209	git(mainSrc, "add", ".")
		210	git(mainSrc, "commit", "-q", "-m", "base")
		211	git(mainSrc, "push", "-q", dir, "main")
		212
		213	// An unrelated repository: no common commit with main.
		214	otherSrc := filepath.Join(root, "other-src")
		215	os.MkdirAll(filepath.Join(otherSrc, ".gitbay"), 0o755)
		216	os.MkdirAll(filepath.Join(otherSrc, "docs"), 0o755)
		217	os.WriteFile(filepath.Join(otherSrc, ".gitbay", "ci.yml"), []byte(
		218	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo hi\n"), 0o644)
		219	os.WriteFile(filepath.Join(otherSrc, "docs", "x.md"), []byte("# x\n"), 0o644)
		220	git(root, "init", "-q", "-b", "feature", "other-src")
		221	git(otherSrc, "add", ".")
		222	git(otherSrc, "commit", "-q", "-m", "unrelated docs-only")
		223	otherSHA := strings.TrimSpace(git(otherSrc, "rev-parse", "HEAD"))
		224	git(otherSrc, "push", "-q", dir, "feature")
		225
		226	QueueBranchBuilds(st, root, "https://x.test", repo, uid, "feature", testZeroSHA, otherSHA, time.Now())
		227
		228	builds, err := st.ListBuilds(repo.ID, 10)
		229	if err != nil \|\| len(builds) != 1 {
		230	t.Fatalf("expected fail-open to queue the job: %v %v", builds, err)
		231	}
		232	}
		233
		234	// The first push to a brand-new repository moves the default branch
		235	// itself with no prior commit: the merge base of the default branch
		236	// against its own tip is the tip, which carries no diff. That must
		237	// fail open rather than read as "nothing changed".
		238	func TestQueueBranchBuildsFreshDefaultBranchFailsOpen(t *testing.T) {
		239	st, repo, uid := newQueueTestRepo(t)
		240	git := gitRunner(t)
		241	root := t.TempDir()
		242
		243	src := filepath.Join(root, "src")
		244	os.MkdirAll(filepath.Join(src, ".gitbay"), 0o755)
		245	os.MkdirAll(filepath.Join(src, "docs"), 0o755)
		246	os.WriteFile(filepath.Join(src, ".gitbay", "ci.yml"), []byte(
		247	"jobs:\n unit:\n paths:\n - src/**\n steps:\n - echo hi\n"), 0o644)
		248	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x\n"), 0o644)
		249	git(root, "init", "-q", "-b", "main", "src")
		250	git(src, "add", ".")
		251	git(src, "commit", "-q", "-m", "initial")
		252	sha := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		253
		254	dir := RepoDir(root, repo.OwnerName, repo.Name)
		255	os.MkdirAll(filepath.Dir(dir), 0o755)
		256	git(root, "clone", "-q", "--bare", src, dir)
		257
		258	QueueBranchBuilds(st, root, "https://x.test", repo, uid, "main", testZeroSHA, sha, time.Now())
		259
		260	builds, err := st.ListBuilds(repo.ID, 10)
		261	if err != nil \|\| len(builds) != 1 {
		262	t.Fatalf("expected fail-open on the repository's first commit: %v %v", builds, err)
		263	}
		264	}
		265
		266	// An ordinary push with a genuine old sha is unaffected by the
		267	// new-branch handling: filtering still works exactly as it did before.
		268	func TestQueueBranchBuildsOrdinaryPushStillFilters(t *testing.T) {
		269	st, repo, uid := newQueueTestRepo(t)
		270	git := gitRunner(t)
		271	root := t.TempDir()
		272
		273	src := filepath.Join(root, "src")
		274	os.MkdirAll(filepath.Join(src, ".gitbay"), 0o755)
		275	os.MkdirAll(filepath.Join(src, "docs"), 0o755)
		276	os.WriteFile(filepath.Join(src, ".gitbay", "ci.yml"), []byte(
		277	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo hi\n"), 0o644)
		278	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x\n"), 0o644)
		279	git(root, "init", "-q", "-b", "main", "src")
		280	git(src, "add", ".")
		281	git(src, "commit", "-q", "-m", "base")
		282	oldSHA := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		283
		284	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x changed\n"), 0o644)
		285	git(src, "add", ".")
		286	git(src, "commit", "-q", "-m", "docs only")
		287	newSHA := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		288
		289	dir := RepoDir(root, repo.OwnerName, repo.Name)
		290	os.MkdirAll(filepath.Dir(dir), 0o755)
		291	git(root, "clone", "-q", "--bare", src, dir)
		292
		293	QueueBranchBuilds(st, root, "https://x.test", repo, uid, "main", oldSHA, newSHA, time.Now())
		294
		295	builds, err := st.ListBuilds(repo.ID, 10)
		296	if err != nil {
		297	t.Fatal(err)
		298	}
		299	if len(builds) != 0 {
		300	t.Fatalf("docs-only push with a real old sha queued a build: %+v", builds)
		301	}
		302	}
		303
		304	// QueueMRBuilds keeps failing open with no diff base at all: deriving a
		305	// merge base for the MR head is deliberately out of scope here (#172 —
		306	// filtering a head down to zero jobs leaves it with no statuses, which
		307	// the require_checks gate reads as unmergeable). This test documents
		308	// and locks in that choice.
		309	func TestQueueMRBuildsStillFailsOpen(t *testing.T) {
		310	st, repo, uid := newQueueTestRepo(t)
		311	git := gitRunner(t)
		312	root := t.TempDir()
		313
		314	src := filepath.Join(root, "src")
		315	os.MkdirAll(filepath.Join(src, ".gitbay"), 0o755)
		316	os.MkdirAll(filepath.Join(src, "docs"), 0o755)
		317	os.WriteFile(filepath.Join(src, ".gitbay", "ci.yml"), []byte(
		318	"jobs:\n unit:\n paths-ignore:\n - docs/**\n steps:\n - echo hi\n"), 0o644)
		319	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x\n"), 0o644)
		320	git(root, "init", "-q", "-b", "main", "src")
		321	git(src, "add", ".")
		322	git(src, "commit", "-q", "-m", "base")
		323
		324	git(src, "checkout", "-q", "-b", "pr")
		325	os.WriteFile(filepath.Join(src, "docs", "x.md"), []byte("# x changed\n"), 0o644)
		326	git(src, "add", ".")
		327	git(src, "commit", "-q", "-m", "docs only")
		328	prSHA := strings.TrimSpace(git(src, "rev-parse", "HEAD"))
		329
		330	dir := RepoDir(root, repo.OwnerName, repo.Name)
		331	os.MkdirAll(filepath.Dir(dir), 0o755)
		332	git(root, "clone", "-q", "--bare", src, dir)
		333	git(dir, "update-ref", "refs/merge-requests/1/head", prSHA)
		334
		335	QueueMRBuilds(st, root, "https://x.test", repo, uid, 1, prSHA)
		336
		337	builds, err := st.ListBuilds(repo.ID, 10)
		338	if err != nil \|\| len(builds) != 1 {
		339	t.Fatalf("expected the MR head to fail open and queue a build: %v %v", builds, err)
		340	}
		341	}

Commit 9a2a62e575

Commit `9a2a62e575`