fix(ci): validate stacked PRs against explicit audit bases

[BillLeoutsakosvl346]

Summary

• Run the existing non-deploying validation for same-repository stacked PRs, while retaining primary-base fork PR coverage and existing push/deployment gates.
• Pin PR audits to the event base SHA and require an explicit full comparison SHA for manual runs. Preserve the new-branch push fallback.
• Remove unused secret inheritance from the validation-only workflow call.

Type of Change

• Bug fix

Testing

• actionlint 1.7.12 passed for both workflows.
• Exercised six event-gating cases and eight executions of the actual audit-base shell against a shallow Git fixture.
• Verified the real block-registry and migration audits detect an earlier change that a HEAD~1 comparison misses; existing migration-audit tests pass.
• Repository lint, all 46 audits, block-registry and docs-manifest checks pass. Required generators produce no changes.
• Normal PR CI passed.
• Manual dispatch with an explicit comparison SHA passed.
• Actual same-repository stacked PR CI passed, including both diff-based audits; deployment jobs stayed skipped. Temporary fixture PR test(ci): temporary stacked PR trigger verification #7663 was closed without merging.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 9, 2026 6:06pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the revised event gating and audit-base resolution preserve existing push behavior while correctly covering same-repository stacked pull requests.

Summary

• Removes the pull-request branch trigger filter and applies explicit job-level gating for primary branches, same-repository stacks, and fork coverage.
• Uses the event base SHA for pull requests, the event predecessor for pushes, and a required explicit SHA for manual runs.
• Validates and resolves comparison commits before running block-registry and migration audits.
• Removes unused secret inheritance from the reusable validation workflow.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  E[Workflow event] --> T{Event type}
  T -->|Pull request| P[Use event base SHA]
  T -->|Manual dispatch| M[Use comparison_base input]
  T -->|Push with predecessor| B[Use event before SHA]
  T -->|New branch push| N[Use HEAD~1]
  P --> V[Require full 40-character SHA]
  M --> V
  B --> V
  N --> V
  V --> F[Fetch and resolve commit]
  F --> A[Run block-registry and migration audits]

Loading