Handle explicit base ranges in shallow clones

Author: lelia

socketsecurity/core/git_interface.py

@@ -183,6 +183,7 @@ def __init__(self, path: str, base_commit_sha: str | None = None):
                 provider="explicit base commit",
                 base_ref=self.base_commit_sha,
                 head_ref=None,
+                use_merge_base=False,
             )
             if detected:
                 detection_source = "explicit-base-commit"
@@ -348,8 +349,9 @@ def _detect_pull_request_changes(
             provider: str,
             base_ref: str,
             head_ref: str | None,
+            use_merge_base: bool = True,
     ) -> bool:
-        """Detect a full PR range locally, fetching only refs needed to complete it."""
+        """Detect a base-to-head range locally, fetching only refs needed to complete it."""
         base_commit = self._resolve_ref(base_ref)
         if base_commit is None:
             base_commit = self._fetch_ref(base_ref, f"{provider} pull-request base ref missing")
@@ -358,7 +360,8 @@ def _detect_pull_request_changes(
             return False
 
         head_commit = self.commit.hexsha
-        diff_range = f"{base_commit}...{head_commit}"
+        range_separator = "..." if use_merge_base else ".."
+        diff_range = f"{base_commit}{range_separator}{head_commit}"
         try:
             diff_files = self.repo.git.diff("--name-only", diff_range)
             self.show_files = diff_files.splitlines()
@@ -384,7 +387,7 @@ def _detect_pull_request_changes(
         try:
             diff_files = self.repo.git.diff(
                 "--name-only",
-                f"{base_commit}...{head_commit}",
+                f"{base_commit}{range_separator}{head_commit}",
             )
             self.show_files = diff_files.splitlines()
             log.debug(

tests/unit/test_git_interface.py

@@ -305,6 +305,37 @@ def test_explicit_base_commit_covers_the_whole_range(
     )
 
 
+def test_explicit_base_commit_does_not_require_merge_base(
+        commit_range_repo, tmp_path, mocker,
+):
+    shallow_path = tmp_path / "shallow-range-repo"
+    _git(
+        tmp_path,
+        "clone",
+        "--depth=1",
+        "--branch=feature",
+        commit_range_repo.path.as_uri(),
+        str(shallow_path),
+    )
+    mocker.patch.object(Git, "ensure_safe_directory")
+
+    repository = Git(
+        str(shallow_path),
+        base_commit_sha=commit_range_repo.base_sha,
+    )
+
+    # Fetching the base supplies both endpoint trees but does not deepen the
+    # feature history enough to calculate a merge base.
+    merge_base = subprocess.run(
+        ["git", "merge-base", commit_range_repo.base_sha, "HEAD"],
+        cwd=shallow_path,
+        capture_output=True,
+        text=True,
+    )
+    assert merge_base.returncode != 0
+    assert sorted(repository.changed_files) == ["App.java", "pom.xml"]
+
+
 def test_explicit_base_commit_takes_precedence_over_ci_environment(
         commit_range_repo, monkeypatch, mocker, caplog,
 ):