From 5de92d7a27930f501803db6bc87f71dc000ad43f Mon Sep 17 00:00:00 2001
From: NWarila <33955773+NWarila@users.noreply.github.com>
Date: Tue, 2 Jun 2026 20:22:26 +0000
Subject: [PATCH] ci(repo-ci): scan the full push range for attribution residue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On pull_request the check scans origin/<base>..HEAD. On push, github.base_ref
is empty, so AI_RESIDUE_BASE_REF resolved to a bogus ref and the check fell
back to scanning only the single HEAD commit — narrower than intended and prone
to false positives on a HEAD whose body merely mentions a marker word. Use
github.event.before..HEAD on push so every pushed commit is scanned and commits
already on the base branch are not re-scanned. Matching logic is unchanged.
---
 .github/workflows/repo-ci.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/repo-ci.yml b/.github/workflows/repo-ci.yml
index 57b610c..81a6ca6 100644
--- a/.github/workflows/repo-ci.yml
+++ b/.github/workflows/repo-ci.yml
@@ -67,7 +67,11 @@ jobs:
         run: git fetch --no-tags origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
       - run: python tools/check_ai_residue.py
         env:
-          AI_RESIDUE_BASE_REF: origin/${{ github.base_ref }}
+          # On pull_request, scan origin/<base>..HEAD (the PR's commits).
+          # On push, github.base_ref is empty, so scan github.event.before..HEAD
+          # (every commit in the push) instead of only HEAD — wider coverage,
+          # and avoids re-scanning commits already on the base branch.
+          AI_RESIDUE_BASE_REF: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || github.event.before }}
 
   adr-schema:
     name: Validate ADR schema