Revert "Resolve trusted PR bundle validation base from the base branch tip" (#68795)

This reverts commit 96b2d13.

Roll back #68717 in full at user request. Fetching the live base branch tip without an explicit depth bound may transfer substantial history in massive shallow monorepos; no production bandwidth measurement is available.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: pelikhan

actions/setup/js/push_to_pull_request_branch.cjs

@@ -139,33 +139,18 @@ async function getBundlePreApplyFiles(exec, gitOptions, rangeBaseRef, bundleRef,
  */
 async function getBundleValidationBase(exec, gitOptions, oldHead, candidate, trustedBase) {
   const fallback = { ref: oldHead, conflictedFiles: [] };
-  if (!trustedBase) {
-    core.debug("Bundle validation: no trusted base available; using PR-head validation");
-    return fallback;
-  }
+  if (!trustedBase) return fallback;
   try {
-    const opts = { ...gitOptions, ignoreReturnCode: true, silent: true };
+    const opts = { ...gitOptions, ignoreReturnCode: true };
     const oldAncestor = await exec.getExecOutput("git", ["merge-base", "--is-ancestor", oldHead, candidate], opts);
     const baseAncestor = await exec.getExecOutput("git", ["merge-base", "--is-ancestor", trustedBase, candidate], opts);
     const alreadyMerged = await exec.getExecOutput("git", ["merge-base", "--is-ancestor", trustedBase, oldHead], opts);
-    if (oldAncestor.exitCode !== 0) {
-      core.debug("Bundle validation: candidate does not descend from PR head or ancestry is unavailable; using PR-head validation");
-      return fallback;
-    }
-    if (baseAncestor.exitCode !== 0) {
-      core.debug("Bundle validation: candidate does not include trusted base or ancestry is unavailable; using PR-head validation");
-      return fallback;
-    }
-    if (alreadyMerged.exitCode !== 1) {
-      core.debug("Bundle validation: trusted base is already in PR head or ancestry is unavailable; using PR-head validation");
-      return fallback;
-    }
+    if (oldAncestor.exitCode !== 0 || baseAncestor.exitCode !== 0 || alreadyMerged.exitCode !== 1) return fallback;
 
     const merge = await exec.getExecOutput("git", ["merge-tree", "--write-tree", "--name-only", "-z", oldHead, trustedBase], opts);
     const [tree, ...fields] = merge.stdout.split("\0");
     if ((merge.exitCode === 0 || merge.exitCode === 1) && /^[0-9a-f]{40}$/.test(tree)) {
       const separatorIndex = fields.indexOf("");
-      core.debug(merge.exitCode === 1 ? "Bundle validation: trusted-base merge tree selected with conflicts" : "Bundle validation: trusted-base merge tree selected without conflicts");
       return {
         ref: tree,
         conflictedFiles: merge.exitCode === 1 ? fields.slice(0, separatorIndex === -1 ? fields.length : separatorIndex) : [],
@@ -1115,22 +1100,14 @@ async function main(config = {}) {
           // Resolve from GitHub metadata and fetch from the target checkout's
           // origin, never from agent-supplied refs or patch headers.
           let trustedBase = "";
-          const baseRef = pullRequest.base?.ref;
-          if (!signedCommits && typeof baseRef === "string" && baseRef) {
+          const baseSha = pullRequest.base?.sha;
+          if (!signedCommits && typeof baseSha === "string" && /^[0-9a-f]{40}$/.test(baseSha)) {
             try {
-              await exec.exec("git", ["fetch", "origin", `refs/heads/${baseRef}`], { env: { ...process.env, ...gitAuthEnv }, ...baseGitOpts, silent: true });
-              const { stdout } = await exec.getExecOutput("git", ["rev-parse", "--verify", "FETCH_HEAD^{commit}"], { ...baseGitOpts, silent: true });
-              if (/^[0-9a-f]{40}$/.test(stdout.trim())) {
-                trustedBase = stdout.trim();
-                core.debug("Bundle validation: fetched trusted base branch tip");
-              } else {
-                core.debug("Bundle validation: fetched base tip is invalid; using PR-head validation");
-              }
-            } catch {
-              core.warning("Unable to fetch trusted PR base; using PR-head validation");
+              await exec.exec("git", ["fetch", "origin", baseSha], { env: { ...process.env, ...gitAuthEnv }, ...baseGitOpts });
+              trustedBase = baseSha;
+            } catch (baseFetchError) {
+              core.warning(`Unable to fetch trusted PR base; using PR-head validation: ${getErrorMessage(baseFetchError)}`);
             }
-          } else {
-            core.debug(signedCommits ? "Bundle validation: trusted-base resolution skipped for signed commits" : "Bundle validation: trusted-base resolution skipped because base branch metadata is unavailable");
           }
           await ensureFullHistoryForBundle(
             exec,
@@ -1208,42 +1185,12 @@ async function main(config = {}) {
             }
           }
           core.info(`Fetched bundle to ${bundleRef}`);
-          let validationBase = await getBundleValidationBase(exec, baseGitOpts, rangeBaseRef, bundleRef, trustedBase);
-          const workflowSha = process.env.GITHUB_SHA;
-          if (trustedBase && validationBase.ref === rangeBaseRef && typeof workflowSha === "string" && /^[0-9a-f]{40}$/.test(workflowSha) && workflowSha !== trustedBase) {
-            core.debug("Bundle validation: checking workflow-start base fallback");
-            try {
-              // A run SHA is trusted only if it belongs to the fetched base branch,
-              // not an agent-controlled PR head or a pull_request merge ref.
-              const runOnBase = await exec.getExecOutput("git", ["merge-base", "--is-ancestor", workflowSha, trustedBase], { ...baseGitOpts, ignoreReturnCode: true, silent: true });
-              if (runOnBase.exitCode === 0) {
-                validationBase = await getBundleValidationBase(exec, baseGitOpts, rangeBaseRef, bundleRef, workflowSha);
-                if (validationBase.ref !== rangeBaseRef) {
-                  trustedBase = workflowSha;
-                  core.debug("Bundle validation: workflow-start base fallback selected");
-                } else {
-                  core.debug("Bundle validation: workflow-start base fallback did not establish a baseline");
-                }
-              } else {
-                core.debug("Bundle validation: workflow-start base fallback rejected because base-branch ancestry is unverified");
-              }
-            } catch {
-              core.warning("Unable to verify workflow SHA on the trusted base branch; using PR-head validation");
-            }
-          } else {
-            core.debug(
-              validationBase.ref !== rangeBaseRef
-                ? "Bundle validation: workflow-start base fallback skipped because base tip established a baseline"
-                : "Bundle validation: workflow-start base fallback skipped because no distinct valid workflow base is available"
-            );
-          }
+          const validationBase = await getBundleValidationBase(exec, baseGitOpts, rangeBaseRef, bundleRef, trustedBase);
           validationBaseRef = validationBase.ref;
           validationConflictFiles = validationBase.conflictedFiles;
           const trustedBaseInValidationBase = validationBaseRef !== rangeBaseRef;
           if (trustedBaseInValidationBase) {
-            core.info("Bundle validation baseline includes trusted base changes");
-          } else {
-            core.info("Bundle validation baseline uses PR head");
+            core.info(`Bundle validation baseline includes trusted base ${trustedBase}: ${validationBaseRef}`);
           }
           const agentHistoryExclusions = [rangeBaseRef];
           if (trustedBaseInValidationBase) agentHistoryExclusions.push(trustedBase);