fix(ci): skip the diff-based audits when there is no base, instead of guessing one

Follow-up to #7033, which merged with this thread open.

A push that creates a branch reports an all-zero `github.event.before`, and the
fallback answered that with `HEAD~1` — auditing the single tip commit while
reporting on the whole push. That is the same partial-audit-reported-as-complete
failure #7033 set out to remove, one case further along.

There is no correct base to substitute. Nothing precedes the push, and diffing
the whole history would lint every migration ever written. So the audits skip
with a `::notice::` naming the reason. A stated skip is honest; a partial audit
wearing a green check is not.

The same branch also covers `workflow_dispatch`, where `before` is empty rather
than all-zero because there is no push payload at all. The guard has to test both
— an empty `before` reaching the fetch would run `git fetch origin ""` and fail
the job outright, which this workflow allows since it declares `workflow_dispatch`.

Dropping the fallback drops its only consumer: `fetch-depth: 2` existed to give
`HEAD~1` something to resolve to, and `before` is fetched by SHA, so the checkout
returns to the default depth.

Traced all four event shapes through the branch — PR, ordinary push, branch
creation, manual dispatch — and verified both audits still pass against a raw SHA
base.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -14,18 +14,8 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      # The diff-based audits below need a base commit to read, and the default
-      # depth of 1 clones a single commit with no parent. They normally fetch
-      # their base by SHA (see "Resolve base ref"), so this depth only covers the
-      # `HEAD~1` fallback — but without it that fallback resolves to nothing.
-      #
-      # Worth stating because the failure was invisible for so long: the migration
-      # audit read the resulting `git diff` failure as "no migrations changed" and
-      # exited 0, so it had never actually run on a push build.
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          fetch-depth: 2
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -114,39 +104,43 @@ jobs:
 
           echo "✅ All env flags are properly configured"
 
-      # One fetch for both base-ref audits, and no `|| true`: a swallowed fetch leaves
-      # the base ref absent, which neither audit can tell apart from a branch that
-      # changed nothing. The block-registry check at least degrades to a visible
-      # `⚠ … skipping` line; the migration audit printed `✓ No new migrations to
-      # check` and exited 0, clearing the only guard on production DDL.
-      #
-      # Depth stays at 1 — without a merge-base the migration audit diffs the two
-      # tips, which under `--diff-filter=AM` is exactly the migrations new here.
       # Resolved once for both diff-based audits, and never with `|| true`: a
       # swallowed fetch leaves the base absent, which neither audit can tell apart
-      # from a branch that changed nothing.
+      # from a branch that changed nothing. That is how the migration audit came
+      # to print `✓ No new migrations to check` and exit 0 on every push build,
+      # having read nothing — and it is the only guard on production DDL.
       #
       # On push the base is `github.event.before`, the tip the branch had before
-      # this push — not `HEAD~1`, which names only the last commit and would let a
-      # multi-commit push slip every earlier commit's migrations past the audit.
-      # It is fetched by SHA at depth 1; the audits diff two tips and need no
-      # common ancestry. An all-zero `before` means the branch is new and has no
-      # predecessor to diff, so `HEAD~1` remains the fallback there.
+      # this push. It is fetched by SHA at depth 1, so the checkout needs no extra
+      # history; the audits diff two tips and need no common ancestry between them.
+      #
+      # A push that creates the branch reports an all-zero `before` and genuinely
+      # has no predecessor, so the audits skip with a notice rather than falling
+      # back to a commit. Auditing one commit while reporting on the whole push is
+      # the failure this step exists to remove.
       - name: Resolve base ref for diff-based audits
         id: audit_base
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             git fetch --depth=1 origin "${{ github.base_ref }}"
             echo "ref=origin/${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
-          elif [ -n "${{ github.event.before }}" ] &&
-               [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then
+          elif [ -z "${{ github.event.before }}" ] ||
+               [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+            # No predecessor to diff against. All-zero means the push created the
+            # branch; empty means this was not a push at all — `workflow_dispatch`
+            # carries no push payload, and dropping that guard would run
+            # `git fetch origin ""` and fail the job. Say so and let the audits
+            # skip: naming a commit here would audit that one commit while
+            # reporting on the whole push.
+            echo "::notice::No preceding commit to diff against; skipping the diff-based audits."
+            echo "ref=" >> "$GITHUB_OUTPUT"
+          else
             git fetch --depth=1 origin "${{ github.event.before }}"
             echo "ref=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "ref=HEAD~1" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Check block registry invariants
+        if: steps.audit_base.outputs.ref != ''
         run: bun run apps/sim/scripts/check-block-registry.ts "${{ steps.audit_base.outputs.ref }}"
 
       - name: Lint code
@@ -162,6 +156,7 @@ jobs:
         run: bun run docs-manifest:check
 
       - name: Migration safety (zero-downtime) audit
+        if: steps.audit_base.outputs.ref != ''
         run: bun run check:migrations "${{ steps.audit_base.outputs.ref }}"
 
       # Every workspace, not just realtime. packages/emcn, packages/utils,