Match dependency snapshots between main and update pull requests #2490

Observed failure

GitHub's live dependency graph compare for dependency PR #2452 returned HTTP 200 with a snapshot warning: the base commit ba2777d1b008c2148d413e07cc497791966310e0 had 3 snapshots and the PR head 5e5864e8cbf7ebdd606fd8c3fd8ea8624d0b4403 had 1. GitHub warns that the diff may show unexpected removals. The warning was fetched again on 2026-10-28 after the branch refresh. This can make the dependency review evidence for an update PR misleading even when the API returns 200.

Issue #2485 addresses the separate failure to save a large dependency diff. Closed issue #2243 addressed nondeterministic Python dependency versions, not this base/head snapshot-count mismatch.

Hosted diagnostics — 2026-10-28

• Draft #2492 proposed scanning the same full tree on main and PR heads. Temporary real fast-uri canary #2493 still compared 3 base snapshots to 1 head after a 300-second retry and showed 55 unrelated uv.lock removals. It closed unmerged.
• A second real canary #2494 used upstream component-detection action v0.2.0. Its head snapshot submitted successfully, yet the compare still warned 3 versus 1 after 300 seconds. The API returned 1,482 changes, including 1,347 removals under ../../_temp/dependency-review-base/. The action's no-moderate-vulnerability result was limited by that warning; the evidence recorder rejected the incomplete comparison. test: check v0.2.0 snapshot manifest mapping on fast-uri update #2494 closed unmerged.
• A third temporary off-main canary #2495 used a fresh diagnostic base branch. Both base and head snapshot submission steps reported success, and the review action showed only fast-uri 3.1.7 → 3.1.9 with no moderate-or-higher vulnerability or denied package. The independent compare API still warned “No snapshots were found for the head SHA” more than five minutes after submission; the evidence recorder rejected it and no artifact was saved. Three unrelated test/coverage failures came from deliberately widening the temporary push trigger, which the repository guard forbids. test: verify dependency snapshots on clean temporary base #2495 closed unmerged and its temporary branches were removed. A later independent API readback on the same exact off-main commits returned HTTP 200 with an empty snapshot-warning header and only the two intended fast-uri entries: 3.1.7 removed, 3.1.9 added. GitHub’s commit compare also shows one changed file, package-lock.json. This confirms that the controlled comparison eventually became available, but it did not turn the earlier hosted check green or create the missing evidence artifact. Its base was not main, so it does not establish the outcome for the original update PRs against main; the reason for the long delay remains unverified.
• Read-only comparisons of recent main commits showed snapshot counts varying 1 → 2 → 1 → 2 → 3; a new main SHA by itself is not proof of a warning-free comparison.
• These tests show that the full-tree change and v0.2.0 pin alone do not establish parity against the current base SHA. The temporary-path entries are observed in the base comparison; their exact submission source and the effect of a fresh main SHA still require verification.

Expected behavior

For pull requests changing dependency manifests, submit a dependency graph snapshot for the exact PR head using the same full-tree scanner used on main. Keep vulnerability and license policy intact, and reject warning-bearing compare responses before recording them as complete evidence. Keep the existing per-file Python scan timeout and declared-dependency fallback visible as a limitation; it may omit transitive dependencies.

Acceptance criteria

• Use matching full-tree dependency snapshot submission on main and same-repository dependency PR heads; do not submit a focused one-ecosystem head snapshot against a full-tree base snapshot.
• Keep the exact head SHA/ref binding and existing dependency review severity/license policy.
• Add focused tests for manifest-change selection, matching submission path, snapshot warning rejection, and Python scan fallback behavior.
• Run the hosted workflow on a real dependency PR and verify the exact base/head compare has no snapshot warning, the artifact is complete, and the required dependency review verdict reflects the intended changes.

Current status — 2026-10-29

#2487 merged at approved head 148cbf55fdce412255d2a61780459143521fa4c4; current main is e010c9f3cec5ae72be16814d0841578ea9f8ded2 and has the same tree as that head. Draft #2492 now targets main at head 85f1815ddb7ec121680d067d165e18eb40d90eda. Its local merge tree is exactly its head tree, all current-head hosted checks are successful or skipped, and it has no open review threads. Those checks used the code-only path and do not prove a dependency comparison against main.

Controlled off-main #2501 passed a real four-file dependency update with a warning-free compare and all 12 exact lockfile changes in its artifact; it closed unmerged. This supports the #2492 repair but does not satisfy this issue's current-main acceptance criterion. #2492 is ready for a separate merge decision. If merged, first verify the new main full-tree and combined-lock snapshot submissions, then refresh an original manifest-changing PR onto that exact base and require a warning-free hosted policy verdict and complete artifact. Keep this issue open until that real update passes. The earlier failed canaries above remain historical diagnostics.

Verified current-main result — 2026-10-29

#2492 merged at its separately approved exact head into main commit 0c99258342fa862e6bb1b38f8dc819879bf83175. Main dependency run 40828223753 succeeded at that exact SHA: both full-tree and combined npm/uv lock snapshot submissions passed. The combined submission was bound to refs/heads/main and reported four manifests, 2,172 packages, snapshot ID 115674463.

Original fast-uri update PR #2452 was refreshed onto that main at head ec5a8fe6aef60fade2cd4febbe986ec50167691d. Its PR diff remains only package-lock.json (three additions, three deletions). Hosted run 40828788486 passed head full-tree and combined-lock submissions, dependency-review policy, evidence recording, and artifact upload. At this head, 26 checks succeeded and three were skipped, with none failing or pending.

The uploaded artifact dependency-review-ec5a8fe6aef60fade2cd4febbe986ec50167691d-1 (ID 12878465028) records review_outcome: success and exactly two package-lock.json development-scope rows: fast-uri 3.1.7 removed and 3.1.9 added, both BSD-3-Clause and with no reported vulnerability entries. Its diff SHA-256 is 2c65597860d4717a61f583496d79fb2b4f62e3a75d363c9a2f51f2d1c128fb09, matching the downloaded file. An independent GitHub dependency-graph compare of the same base/head with the review action's per_page=5 request returned HTTP 200, an empty snapshot-warning header, and rows identical to that artifact. This satisfies this issue's exact-main comparison and evidence acceptance.

PR #2452 remains OPEN and unmerged for its own review decision. The other original dependency PRs still require individual refresh, hosted checks, artifact inspection, and merge decisions where applicable. Closing this issue records the shared snapshot repair only.