Find an incremental baseline by commit ancestry when the branch has none

[Ibrahimrahhal]

A small percentage of pipelines are checked out with detached head (no branch is resolved) so we aren't able to locate the same branch base so I'm adding a fallback to try to identify a base using the commit history instead.

LLM desc:

Problem

The CLI only finds a baseline by branch name: the scanned branch, then origin/HEAD, then main or master. Two common cases find nothing, even when a recent ancestor commit was scanned:

• Detached HEAD. This is how CI checkouts such as Harness or Drone usually land. The pipeline's own earlier scans were uploaded with a commit but a null branch, so a name lookup never matches them.
• First scan of a branch whose trunk is not main or master. For example, a project whose trunk is develop. The trunk lookup never asks about develop, so the branch scans everything. Production data shows this is a significant share of full CLI scans.

The git-diff path also refused outright whenever branch was None, although it never used the branch.

Change

• Local ancestry walk. Walks HEAD's nearest 10 commits breadth-first over every parent, so both sides of a merge count. A shallow clone stops at its depth. No API calls are involved.
• One lookup by commit list. Sends GET /api/v1/scans?sha=<c1>,<c2>,... with the usual baseline filters (engine, complete, no PRs, full project state, clean when checksums are unusable) and no branch filter. Up to 3 pages of 50 are read, stopping at the first page with any candidate. Matches are re-checked client-side against the walked commits, because a backend that ignores sha returns scans of any commit.
• Pick the nearest. Fewest commits back wins. Among scans of the same commit, stored checksums win, then recency. A run that cannot git diff only accepts ancestors with checksums. That decision comes from the same git_diff_refusal function that plan_git_diff refuses with, so a later change to when a git diff is allowed (such as Diff the working tree when it is dirty, instead of scanning everything #170) applies to both.
• New lookup order. The branch's own scans come first, then ancestry, then trunk. Ancestry comes before trunk because a scan of the commit this branch forked from differs only by this branch's own work, while trunk's newest scan also carries whatever trunk did since the fork. On a detached HEAD, the branch step is skipped.
• Backward compatible.
  • A backend without the comma-separated sha support reads the list as one literal commit and returns nothing.
  • If the lookup by commit fails outright (any error status or a network error), it is treated as no match and the trunk lookup still runs, so no project loses the baseline earlier releases found.
  • If the endpoint itself is down, the trunk lookup fails too and the run reports a failed lookup.
  • The "no baseline" message only mentions recent commits when the lookup by commit actually answered.
• Git diff no longer needs a branch. It only needs HEAD's commit and the baseline's commit. A baseline with no commit now gets its own refusal message.
• Output. The run names the baseline as scan of ancestor commit abc1234 (N commits back).

Backend: Corgea/doghouse#2235, now merged, lets sha take a comma-separated list, capped at 50 commits. A client-named baseline (incremental_base_sha or incremental_base_scan_id) is not matched against the upload's branch on the server side.

Tests

• Unit tests over real temp repos:
  • The nearest ancestor is chosen over trunk, sibling and unfetched scans.
  • A scan of HEAD itself is zero commits back.
  • No match when nothing on the page is an ancestor.
  • The checksum tie-break.
  • Checksums are required when a git diff is impossible.
  • HEAD not in the clone.
  • The walk follows both parents of a merge and skips other branches.
  • The walk stops at the commit limit.
  • A git diff with no branch.
• E2E:
  • The request order is updated for branch, then ancestry, then trunk.
  • A develop-trunk baseline found by ancestry, on both a named branch and a detached HEAD.
  • A detached HEAD reaches trunk through a git diff, both when the lookup by commit finds nothing and when it fails with a 400.
  • A failed branch lookup scans everything and says the lookup failed.
• ./harness check passes: all tests, clippy and format.

  

[corgea-security]

nitpick: Ancestor search stops before finding the nearest baseline

The function returns as soon as any page contains an ancestor. Since pages are ordered by scan creation time rather than commit distance, a later page can contain a much nearer ancestor. This contradicts the stated nearest-baseline behavior and can unnecessarily rescan many files. Track the best candidate across all searched pages before returning.

Proof or reproduction:

Page 1: scan(root, 100 commits back) -> immediately returned
Page 2: scan(parent_of_head, 1 commit back) -> never examined

[corgea-security]

Automated review risk: 2/5.

The detached-HEAD baseline logic is sound overall, but pagination can select a substantially older baseline despite promising the nearest ancestor.

No critical or high-priority changes were found.

[corgea-security]

Approved by Dennis: high policy risk and automated risk 2/5.

[cursor]

Two ways a detached run still misses the baseline this change is aiming at, or picks a worse one than the trunk lookup it replaces.

  

_{Sent by Cursor Automation: pr-flow}