Fix create_pull_request rewrite/push parity for excluded files and base drift

actions/setup/js/create_pull_request.cjs

@@ -416,7 +416,10 @@ async function rewriteBundleBranchAsSingleCommit(baseBranch, execApi, bundleFile
   }
 
   core.warning(`Rewriting bundled commits to a single linear commit for signed push compatibility (base: ${baseRef})`);
-  const newHead = await linearizeRangeAsCommit(baseRef, commitHeadline, execApi, { excludedFiles: options.excludedFiles });
+  const newHead = await linearizeRangeAsCommit(baseRef, commitHeadline, execApi, {
+    excludedFiles: options.excludedFiles,
+    rebaseOnto: fallbackBaseRef,
+  });
   core.info(`Bundle rewrite completed (new HEAD: ${newHead})`);
 }
 

actions/setup/js/create_pull_request_validation_push_parity.test.cjs

@@ -18,9 +18,9 @@
  *
  * Both regression tests assert: file_set(patch) == file_set(pushed_commit).
  *
- * The non-rewrite regression now passes with the filtered-bundle fix in place.
- * The merge-commit rewrite regression remains `it.fails(...)` until the rewrite
- * path is updated to preserve parity across base-branch drift as well.
+ * Both regressions now pass: filtered bundle synthesis keeps excluded files out
+ * of the pushed commit, and the merge-commit rewrite path linearizes against
+ * the bundle prerequisite so base-branch drift is not absorbed into the result.
  */
 
 import { describe, it, expect, beforeAll, afterEach, vi } from "vitest";
@@ -297,11 +297,10 @@ describe("create_pull_request – validation/push file-set parity", () => {
    * taken by `rewriteBundleBranchAsSingleCommit` inside `create_pull_request`
    * when signed push refuses merge-commit topology).
    *
-   * When base drift exists, the rewrite path still synthesizes a commit whose
-   * file set does not match the validated patch. Keep this as `it.fails(...)`
-   * until the rewrite/base-drift fix lands.
+   * When base drift exists, the rewritten commit must still match the validated
+   * patch file set rather than reverting or absorbing unrelated base changes.
    */
-  it.fails("merge-commit rewrite path: rewritten commit file set matches validated patch", async () => {
+  it("merge-commit rewrite path: rewritten commit file set matches validated patch", async () => {
     const { generateGitPatch } = require("./generate_git_patch.cjs");
     const { generateGitBundle } = require("./generate_git_bundle.cjs");
     const { applyBundleToBranch, rewriteBundleBranchAsSingleCommit } = require("./create_pull_request.cjs");
@@ -390,8 +389,6 @@ describe("create_pull_request – validation/push file-set parity", () => {
     });
 
     // REGRESSION ASSERTION: the rewritten commit must contain the same files as the patch.
-    // Today this still fails under base drift, which is why the test is marked
-    // `it.fails(...)` until the remaining rewrite-path fix lands.
     const fromPush = fileListFromPushedCommit(safeOutputsRepo, "origin/main");
     expect(fromPush, "rewritten commit should match patch file set after rewrite under base drift").toEqual(fromPatch);
   });

actions/setup/js/git_helpers.cjs

@@ -712,14 +712,17 @@ async function backfillCommitObjects(execApi, commitShas, options = {}) {
  *   invocation (e.g. `["--allow-empty", "--no-verify"]`).
  * @param {string[]} [opts.excludedFiles] - Paths that should be removed from the staged rewrite
  *   before creating the linearized commit.
+ * @param {string} [opts.rebaseOnto] - Optional ref to replay the synthesized commit onto after
+ *   it has been linearized relative to `baseRef`. Use this when `baseRef` captures the agent's
+ *   actual change base but the resulting single commit must sit on a newer branch tip.
  * @param {number} [opts.maxCommits] - Override the implausibility threshold (default
  *   `SHALLOW_RANGE_MAX_COMMITS`).  Set to `Infinity` to disable the shallow guard.
  * @returns {Promise<string>} The new HEAD SHA after the rewrite.
  * @throws {Error} If the soft reset, staged-changes validation, or recommit fails, or if a
  *   shallow checkout produces an implausible commit range.
  */
 async function linearizeRangeAsCommit(baseRef, commitMessage, execApi, opts = {}) {
-  const { gitOpts, commitFlags = [], excludedFiles = [], maxCommits = SHALLOW_RANGE_MAX_COMMITS } = opts;
+  const { gitOpts, commitFlags = [], excludedFiles = [], rebaseOnto, maxCommits = SHALLOW_RANGE_MAX_COMMITS } = opts;
   // Spread gitOpts into exec calls only when it is explicitly provided — passing
   // `undefined` as a third argument changes the arity seen by mocks in tests.
   const execArgs = gitOpts !== undefined ? [gitOpts] : [];
@@ -762,23 +765,62 @@ async function linearizeRangeAsCommit(baseRef, commitMessage, execApi, opts = {}
     throw new Error("Could not resolve current HEAD before linearizing range");
   }
 
+  // Track whether a `git rebase` call was started so the catch block can distinguish
+  // "rebase in progress" (needs --abort) from "pre-rebase failure" (needs reset only).
+  let rebaseStarted = false;
   try {
     await execApi.exec("git", ["reset", "--soft", baseRef], ...execArgs);
     if (Array.isArray(excludedFiles) && excludedFiles.length > 0) {
       const { stdout: excludedStagedOut } = await execApi.getExecOutput("git", ["diff", "--cached", "--name-only", "--", ...excludedFiles], ...execArgs);
       if (excludedStagedOut.trim()) {
-        await execApi.exec("git", ["checkout", "HEAD", "--", ...excludedFiles], ...execArgs);
+        // Use `git reset HEAD -- <files>` rather than `git checkout HEAD -- <files>`.
+        // For newly-added excluded files (not present in HEAD), `checkout` fails with
+        // "pathspec did not match any file(s) known to git". `reset HEAD --` handles
+        // both cases: removes new files from the index and restores modified files to
+        // the HEAD version, without touching the working tree.
+        await execApi.exec("git", ["reset", "HEAD", "--", ...excludedFiles], ...execArgs);
+        // For excluded files that were modifications (not new additions), the working tree
+        // still has the agent's version while the index was just restored to HEAD. This
+        // creates an unstaged change that would cause `git rebase --onto` to fail.
+        // Detect any such unstaged changes among the excluded files and restore them from
+        // the index so the working tree stays in sync before the commit and rebase steps.
+        const { stdout: modifiedExcludedOut } = await execApi.getExecOutput("git", ["diff", "--name-only", "--", ...excludedFiles], ...execArgs);
+        const modifiedExcluded = modifiedExcludedOut.trim().split("\n").filter(Boolean);
+        if (modifiedExcluded.length > 0) {
+          await execApi.exec("git", ["checkout", "--", ...modifiedExcluded], ...execArgs);
+        }
       }
     }
     const { stdout: stagedFilesOut } = await execApi.getExecOutput("git", ["diff", "--cached", "--name-only"], ...execArgs);
     if (!stagedFilesOut.trim()) {
       throw new Error(`No staged changes found after soft reset to ${baseRef}. ` + `The commit range may contain only no-op or empty commits. ` + `Ensure your commits contain actual file changes before pushing.`);
     }
     await execApi.exec("git", ["commit", ...commitFlags, "-m", commitMessage], ...execArgs);
+    if (typeof rebaseOnto === "string" && rebaseOnto.trim() && rebaseOnto.trim() !== baseRef.trim()) {
+      rebaseStarted = true;
+      await execApi.exec("git", ["rebase", "--onto", rebaseOnto.trim(), baseRef, "HEAD"], ...execArgs);
+      rebaseStarted = false;
+      // Guard: if the rebase silently dropped the commit (became empty relative to rebaseOnto),
+      // the agent's changes are lost. Detect and fail loudly rather than pushing an empty diff.
+      const { stdout: diffOut } = await execApi.getExecOutput("git", ["diff", "--name-only", rebaseOnto.trim(), "HEAD"], ...execArgs);
+      if (!diffOut.trim()) {
+        throw new Error(`Rebase onto ${rebaseOnto} produced no changes; the synthesized commit was dropped as empty`);
+      }
+    }
     const { stdout: newHeadOut } = await execApi.getExecOutput("git", ["rev-parse", "HEAD"], ...execArgs);
     return newHeadOut.trim();
   } catch (rewriteError) {
     try {
+      if (rebaseStarted) {
+        // A rebase was in progress when the error occurred; abort it to restore the repo to its
+        // pre-rebase state before the hard reset below finishes the rollback.
+        try {
+          await execApi.exec("git", ["rebase", "--abort"], ...execArgs);
+        } catch (abortError) {
+          // --abort failed while a rebase was genuinely in progress — repo may be in a dirty state.
+          core.error(`linearizeRangeAsCommit: rebase --abort also failed: ${getErrorMessage(abortError)}`);
+        }
+      }
       await execApi.exec("git", ["reset", "--hard", originalHead], ...execArgs);
       core.warning(`linearizeRangeAsCommit: rewrite failed; restored original HEAD ${originalHead}`);
     } catch (restoreError) {

actions/setup/js/git_helpers.test.cjs

@@ -1392,7 +1392,7 @@
       }
       // Either path (shallow→early false, or non-shallow→no merge commits found→false)
       // yields false for a linear single-commit range.
       expect(result).toBe(false);
       void isShallow; // used above to document expected behavior
     });
   });
@@ -1620,6 +1620,90 @@
       expect(fs.existsSync(path.join(repoDir, "r.txt"))).toBe(true);
     });
 
+    it("can replay the synthesized commit onto a newer origin/main tip without reverting base drift", async () => {
+      const { linearizeRangeAsCommit } = requireLocal("./git_helpers.cjs");
+
+      const originalBaseSha = spawnSync("git", ["rev-parse", "HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+      const originalBranch = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+
+      try {
+        execSync("git checkout -b feature-drift", { cwd: repoDir, stdio: "pipe" });
+        addCommit(repoDir, "agent.txt", "agent\n", "add agent change");
+
+        const collaboratorDir = fs.mkdtempSync(path.join(os.tmpdir(), "gh-aw-helpers-collab-"));
+        try {
+          execSync(`git clone ${remoteDir} ${collaboratorDir}`, { stdio: "pipe" });
+          execSync('git config user.email "test@example.com"', { cwd: collaboratorDir, stdio: "pipe" });
+          execSync('git config user.name "Test User"', { cwd: collaboratorDir, stdio: "pipe" });
+          addCommit(collaboratorDir, "drift.txt", "drift\n", "base drift");
+          execSync("git push origin main", { cwd: collaboratorDir, stdio: "pipe" });
+        } finally {
+          fs.rmSync(collaboratorDir, { recursive: true, force: true });
+        }
+
+        execSync("git fetch origin main:refs/remotes/origin/main", { cwd: repoDir, stdio: "pipe" });
+
+        await linearizeRangeAsCommit(originalBaseSha, "Squash agent change", makeRealExecApi(repoDir), {
+          gitOpts: { cwd: repoDir },
+          rebaseOnto: "origin/main",
+        });
+
+        const diffNames = spawnSync("git", ["diff", "--name-only", "origin/main..HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim().split("\n").filter(Boolean);
+        expect(diffNames).toEqual(["agent.txt"]);
+        expect(fs.readFileSync(path.join(repoDir, "drift.txt"), "utf8")).toBe("drift\n");
+
+        const parentSha = spawnSync("git", ["rev-parse", "HEAD^"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+        const currentOriginMain = spawnSync("git", ["rev-parse", "origin/main"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+        expect(parentSha).toBe(currentOriginMain);
+      } finally {
+        execSync(`git checkout ${originalBranch}`, { cwd: repoDir, stdio: "pipe" });
+      }
+    });
+
+    it("aborts cleanly and throws when rebase --onto encounters a conflict", async () => {
+      const { linearizeRangeAsCommit } = requireLocal("./git_helpers.cjs");
+
+      // Setup: main has conflict.txt at a known base.
+      addCommit(repoDir, "conflict.txt", "original\n", "add conflict.txt");
+      execSync("git push origin main", { cwd: repoDir, stdio: "pipe" });
+      const originalBaseSha = spawnSync("git", ["rev-parse", "HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+
+      // Agent branch: modifies the same file.
+      execSync("git checkout -b feature-conflict", { cwd: repoDir, stdio: "pipe" });
+      addCommit(repoDir, "conflict.txt", "agent-change\n", "agent modifies conflict.txt");
+      const agentHeadSha = spawnSync("git", ["rev-parse", "HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+
+      // Collaborator pushes a conflicting change to main (same file, incompatible content).
+      const collaboratorDir = fs.mkdtempSync(path.join(os.tmpdir(), "gh-aw-helpers-conflict-collab-"));
+      try {
+        execSync(`git clone ${remoteDir} ${collaboratorDir}`, { stdio: "pipe" });
+        execSync('git config user.email "test@example.com"', { cwd: collaboratorDir, stdio: "pipe" });
+        execSync('git config user.name "Test User"', { cwd: collaboratorDir, stdio: "pipe" });
+        addCommit(collaboratorDir, "conflict.txt", "base-change\n", "base drift modifies conflict.txt");
+        execSync("git push origin main", { cwd: collaboratorDir, stdio: "pipe" });
+      } finally {
+        fs.rmSync(collaboratorDir, { recursive: true, force: true });
+      }
+
+      execSync("git fetch origin main:refs/remotes/origin/main", { cwd: repoDir, stdio: "pipe" });
+
+      // Rebase will conflict: the squashed diff touches the same file as origin/main.
+      await expect(
+        linearizeRangeAsCommit(originalBaseSha, "Squash agent change", makeRealExecApi(repoDir), {
+          gitOpts: { cwd: repoDir },
+          rebaseOnto: "origin/main",
+        })
+      ).rejects.toThrow(/Failed to linearize/);
+
+      // Repo must be in a clean state — no rebase in progress after the abort.
+      const rebaseHeadExists = fs.existsSync(path.join(repoDir, ".git", "REBASE_HEAD"));
+      expect(rebaseHeadExists).toBe(false);
+
+      // HEAD must be restored to the pre-linearize state (agent's commit, not the squash).
+      const headAfter = spawnSync("git", ["rev-parse", "HEAD"], { cwd: repoDir, encoding: "utf8" }).stdout.trim();
+      expect(headAfter).toBe(agentHeadSha);
+    });
+
     it("throws before any git state mutation for a shallow+implausible range", async () => {
       const shallowDir = fs.mkdtempSync(path.join(os.tmpdir(), "gh-aw-helpers-shallow-lin-"));
       try {