Check conflicting pull requests, and never call an error safe

GitHub skips pull_request workflows while a pull request has merge
conflicts, so the README's workflow now runs on pull_request_target,
which also lets the Action comment on pull requests from forks. On that
trigger the checkout is the base branch itself, which git refuses to
fetch into, so the Action fetches the pull request's commits on their
own and no longer hides a failed fetch.

A pre-flight report that hit an error said "Safe" above it. It now says
the command was not checked, in the text and the Markdown.

Signed-off-by: Jacob Stopak <jacob@initialcommit.io>

Author: initialcommit-io

README.md

@@ -926,7 +926,7 @@ Add this to your repo as `.github/workflows/git-sim.yml`:
 ```yaml
 name: git-sim
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
 permissions:
   contents: read
@@ -961,7 +961,7 @@ To change how it runs, add a `with:` block under the `uses:` line:
 | `package` | `git-sim` | What gets installed: the latest git-sim from PyPI, a pinned version like `git-sim==0.4.0`, or a Git URL |
 | `token` | the workflow's own token | The token used to post the comment, to post as another account or bot |
 
-Pull requests from forks get a read-only token, which can't post comments, so set `comment: "false"`. The graph artifact will still attach to the run.
+The workflow runs on `pull_request_target` because GitHub skips `pull_request` workflows for pull requests with merge conflicts, which are the ones you most want checked. It also lets the Action comment on pull requests from forks. That's safe here because the Action never runs the pull request's code: it only reads its commits.
 
 </details>
 

integrations/github-action/action.yml

@@ -60,7 +60,10 @@ runs:
         NUMBER: ${{ github.event.pull_request.number }}
       run: |
         set -euo pipefail
-        git fetch -q origin "refs/pull/$NUMBER/head:refs/heads/pr-$NUMBER" "$BASE:refs/heads/$BASE" || true
+        # The pull request's commits as a branch git-sim can name. The base is
+        # fetched apart from it: on pull_request_target the checkout is the base
+        # branch itself, which git refuses to fetch into.
+        git fetch -q origin "+refs/pull/$NUMBER/head:refs/heads/pr-$NUMBER"
         git fetch -q origin "$BASE"
         git checkout -q -B "$BASE" "origin/$BASE"
 

src/git_sim/preflight_cli.py

@@ -56,12 +56,12 @@ def words_after_preflight(argv: List[str]) -> List[str]:
 
 def render_text(report: PreflightReport) -> str:
     d = report.to_dict()
+    # a command that couldn't be checked is never called safe
+    if d.get("error"):
+        return f"NOT CHECKED  git {d['command']}".rstrip() + f"\nerror: {d['error']}"
     lines = [
         f"{RISK_LABELS.get(d['risk'], d['risk'].upper())}  git {d['command']}".rstrip()
     ]
-    if d.get("error"):
-        lines.append(f"error: {d['error']}")
-        return "\n".join(lines)
     if d.get("summary"):
         lines += ["", d["summary"]]
     for title, key in (
@@ -82,12 +82,11 @@ def render_text(report: PreflightReport) -> str:
 def render_markdown(report: PreflightReport) -> str:
     """The report as Markdown, for a pull request comment or a chat message."""
     d = report.to_dict()
+    if d.get("error"):
+        return f"### ⚪ Not checked · `git {d['command']}`\n\n**Error:** {d['error']}"
     lines = [
         f"### {RISK_BADGES.get(d['risk'], d['risk'])} · `git {d['command']}`".rstrip()
     ]
-    if d.get("error"):
-        lines += ["", f"**Error:** {d['error']}"]
-        return "\n".join(lines)
     if d.get("summary"):
         lines += ["", d["summary"]]
     for title, key in (

tests/unit_tests/test_preflight_cli.py

@@ -96,6 +96,12 @@ def test_render_text_shows_an_error_only():
     report.error = "Not a git repository: /nowhere"
     text = render_text(report)
     assert text.splitlines()[-1] == "error: Not a git repository: /nowhere"
+    # a command that couldn't be checked is never reported as safe
+    assert text.startswith("NOT CHECKED") and "SAFE" not in text
+    from git_sim.preflight_cli import render_markdown
+
+    md = render_markdown(report)
+    assert md.startswith("### ⚪ Not checked") and "Safe" not in md
 
 
 def test_cli_prints_json_for_a_real_repository(repo):