Skip to content

Comments

Improve rule change detection for merge commits#3988

Closed
eric-sim-sublime wants to merge 2 commits intomainfrom
fix-merge-commit-detection
Closed

Improve rule change detection for merge commits#3988
eric-sim-sublime wants to merge 2 commits intomainfrom
fix-merge-commit-detection

Conversation

@eric-sim-sublime
Copy link
Contributor

When PRs contain merge commits, the workflow can incorrectly detect many unchanged rules as having changes.

Uses three-dot diff (git diff origin/main...HEAD) to better isolate PR changes from main's changes.

Includes test script to validate the detection logic.

The previous logic used git merge-base to find a comparison point, but this
breaks when the PR contains merge commits from main. When comparing files at
HEAD (a merge commit) vs the calculated merge-base, it would incorrectly
detect all of main's recent changes as PR changes.

This fix uses git's three-dot diff syntax (origin/main...HEAD) which
automatically finds the correct merge-base and compares only the changes
introduced by the PR branch, regardless of merge commits.

Changes:
- Use 'git diff origin/main...HEAD --find-renames' to find changed files
- For each file, search for the old file with same rule ID (handles renames)
- Compare source fields using 'git show' directly
- Remove unnecessary sr-main checkout step (no longer needed)
- Handles all merge commit scenarios (HEAD, middle of history, multiple merges)

Benefits:
- Correctly detects only PR changes even with merge commits
- Handles file renames by searching for matching rule IDs
- More efficient (no need to checkout entire base branch)
- More robust (uses git's built-in three-dot diff)

Fixes issue where PRs with merge commits incorrectly triggered tests for
hundreds of unchanged rules (e.g., PR #3982 detected 774 rules when 0 changed).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@eric-sim-sublime eric-sim-sublime requested a review from a team February 9, 2026 21:18
@github-actions github-actions bot added review-needed Indicates that a PR is waiting for review test-rules:excluded:author_membership labels Feb 9, 2026
@github-actions
Copy link

github-actions bot commented Feb 9, 2026

Test Rules Sync - Action Required

This PR was not automatically synced to test-rules because the author is not a member of the sublime-security organization.

To enable syncing, an organization member can comment /update-test-rules on this PR.

Once triggered, the rules will be synced on the next scheduled run (every 10 minutes).

Validates:
- Modified rule source detection
- File renames (via rule ID matching)
- Metadata-only changes (correctly ignored)
- Merge commits (only PR changes detected)
- New files detection

Run with: bash .github/scripts/test_rule_detection.sh
@@ -0,0 +1,264 @@
#!/bin/bash

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this meant to be committed?

done
else
# Use three-dot diff to compare only PR changes, handling merge commits correctly
git fetch origin "${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}" 2>/dev/null || true

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GITHUB_BASE_REF:

The name of the base ref or target branch of the pull request in a workflow run. This is only set when the event that triggers a workflow run is either pull_request or pull_request_target. For example, main.

This workflow runs for:

  push:
    branches: [ "main", "test-rules" ]
  pull_request_target:
    branches:
      - "main"
      - 'ci-testing**'
  workflow_dispatch: {}
  issue_comment:
    types: [ created ]
  merge_group: {}

Note that we don't actually run MQL Mimic for the merge_group. issue_comment is probably the most relevant retrigger for MQL Mimic since that's what test exceptions go through.

get_base_ref is good context and maybe all you need?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review-needed Indicates that a PR is waiting for review test-rules:excluded:author_membership

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants