From 6a8457d8c5bcf996a91ca58b9861510450c7d12f Mon Sep 17 00:00:00 2001
From: Paul Rastoin <45004772+prastoin@users.noreply.github.com>
Date: Fri, 24 Jul 2026 16:01:36 +0200
Subject: [PATCH] fix(ci): diff upgrade mutation guard against the merged base,
 not stale PR base (#23278)

The `server-previous-version-upgrade-mutation-guard` check falsely flags
upgrade commands that landed on `main` as being added/modified by
unrelated PRs (e.g. [run on
#23207](https://github.com/twentyhq/twenty/actions/runs/30097349274/job/89494554178)
flagged six `2-23`/`2-24` files the PR never touched).

## Cause

The guard action diffs `git diff "$BASE_SHA" HEAD` where the PR caller
passes `base_sha: github.event.pull_request.base.sha`.

On a `pull_request` event `HEAD` is the `refs/pull/N/merge` ref, whose
first parent is the *current* tip of `main` it was merged with. But
`pull_request.base.sha` is pinned to the base at the last branch sync
and lags behind. Any upgrade command merged into `main` after that point
exists in `HEAD` but not in the stale base, so the two-dot diff
attributes it to the PR.

Verified against the real merge ref for #23207: diffing against
`base.sha` reproduces the six false offenders from the failing run;
diffing against the merge ref first parent is clean.

## Fix

Derive the base from the merge ref first parent (`HEAD^1`, the actual
merged `main` tip), falling back to `base.sha` only when `HEAD` is not a
merge commit (non-mergeable PR).

The merge-queue caller in `ci-merge-queue.yaml` is unaffected: it passes
`merge_group.base_sha`, which already matches its checkout.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23278?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
---
 .github/workflows/ci-server.yaml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-server.yaml b/.github/workflows/ci-server.yaml
index 388a67301d..a4fa129eca 100644
--- a/.github/workflows/ci-server.yaml
+++ b/.github/workflows/ci-server.yaml
@@ -101,10 +101,23 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 2
+      # HEAD is the pull_request merge ref; its first parent is the exact main
+      # commit it was merged with. pull_request.base.sha can lag behind that,
+      # making commands merged into main since then look added by this PR.
+      - name: Resolve merged base commit
+        id: merged-base
+        shell: bash
+        run: |
+          if git rev-parse -q --verify HEAD^2 >/dev/null; then
+            BASE_SHA=$(git rev-parse HEAD^1)
+          else
+            BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          fi
+          echo "sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
       - name: Validate upgrade command mutations
         uses: ./.github/actions/upgrade-mutation-guard
         with:
-          base_sha: ${{ github.event.pull_request.base.sha }}
+          base_sha: ${{ steps.merged-base.outputs.sha }}
           allow_previous_version_mutation: ${{ contains(github.event.pull_request.labels.*.name, 'ci:allow-previous-version-upgrade-mutation') }}
 
   server-validation: