From 10da97835dc130ffb2b68fd7c739d51961f9bc5d Mon Sep 17 00:00:00 2001
From: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:34:05 -0700
Subject: [PATCH] fix(claude-review): don't re-fetch a base commit the checkout
 already has

On a private repo the review stage died before reaching the agent:

  git fetch --depth=1 origin "$BASE_SHA"
  fatal: could not read Username for 'https://github.com': No such device or address

The PR-head checkout sets persist-credentials: false on purpose, so no token
is left on disk for the agent to read -- which also means a later git fetch has
no credential. Public repos fetch anonymously and never notice; a private repo
has no anonymous access, so the step fails.

The fetch was redundant anyway: that checkout uses fetch-depth: 0, so the base
commit is normally already in the clone. Only fetch when it truly is not
present, which keeps persist-credentials: false intact and adds no token
handling. A genuine missing-object fetch failure still fails the step.

No behavior change for the public repos already using this workflow.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
---
 .github/workflows/reusable_claude_pr_review.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable_claude_pr_review.yml b/.github/workflows/reusable_claude_pr_review.yml
index 36bf722..8bf9925 100644
--- a/.github/workflows/reusable_claude_pr_review.yml
+++ b/.github/workflows/reusable_claude_pr_review.yml
@@ -247,12 +247,22 @@ jobs:
 
       # Add the base commit so the agent can compute the review diff with
       # `git diff $BASE_SHA..HEAD`. No PR code is executed.
+      #
+      # The checkout above uses fetch-depth: 0, so the base commit is normally
+      # already present and no fetch is needed. Only fetch when it genuinely is
+      # not: the checkout sets persist-credentials: false (deliberately -- no
+      # token is left on disk for the agent to read), so on a private repo an
+      # unconditional fetch fails with "could not read Username for
+      # 'https://github.com'". Public repos fetch anonymously and never hit this.
       - name: Fetch base commit for diff
         if: steps.meta.outputs.resolved == 'true'
         working-directory: pr-head
         env:
           BASE_SHA: ${{ steps.meta.outputs.base_sha }}
-        run: git fetch --depth=1 origin "$BASE_SHA"
+        run: |
+          set -euo pipefail
+          git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null \
+            || git fetch --depth=1 origin "$BASE_SHA"
 
       # A reusable workflow does not check out its own repository -- the only
       # checkout above is the PR head under pr-head/. So the pinned requirements