Commit b4f5e4908b for openssl.org

commit b4f5e4908b3fb53f18ecc5180bcc6a3e9b9b54e3
Author: Matt Caswell <matt@openssl.foundation>
Date:   Wed Aug 26 14:45:09 2026 +0100

    Check every changed file in the coding style CI job

    The check-style job built its file list with `gh pr view --json files`.
    That returns only the first 100 entries - gh's GraphQL query asks for
    100 and does not follow further pages - so any pull request touching
    more than 100 files had the remainder silently skipped, and the job
    reported a pass having never examined them.

    This was not hypothetical. The DTLS 1.3 pull request changed 186 files,
    so 86 were dropped - 41 of them .c/.h files clang-format would have
    examined - and the job passed while ssl/statem/statem_srvr.c carried a
    real formatting violation.

    Use the REST files endpoint with --paginate instead, which follows every
    page. Two details worth noting: this endpoint names the field
    `filename` rather than the `path` exposed by gh's GraphQL mapping, and
    per_page is set only to reduce the request count, since the REST
    default of 30 would fetch the same 186 files over seven requests rather
    than two.

    Checked against that same pull request: the old command yields 100
    paths, the new one yields all 186, matching `git diff --name-only`
    exactly. Running pre-commit over each list against the unfixed tree
    confirms the difference - the 100-file list passes, the full list fails
    on ssl/statem/statem_srvr.c.

    Assisted-by: Claude:claude-opus-5
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Mon Sep  7 14:09:40 2026
    Merged-from: https://github.com/openssl/openssl/pull/32516

diff --git a/.github/workflows/style-checks.yml b/.github/workflows/style-checks.yml
index f4d251681d..d2440ab8fd 100644
--- a/.github/workflows/style-checks.yml
+++ b/.github/workflows/style-checks.yml
@@ -24,16 +24,16 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
-      - name: "Get changed files"
-        env:
-          NUMBER: ${{ github.event.pull_request.number }}
-          GH_TOKEN: ${{ github.token }}
+      - name: "Fetch the base commit"
         run: |
-          {
-            echo 'CHANGED_FILES<<EOF'
-            gh pr view $NUMBER --json files --jq '.files.[].path'
-            echo EOF
-          } >> "$GITHUB_ENV"
+          # actions/checkout fetches a single commit by default
+          # (fetch-depth: 1), so the pull request's base commit is not
+          # present and pre-commit cannot work out which files changed.
+          # Depth 1 is enough here: the diff needs the base commit's tree,
+          # not its history.
+          git fetch --depth=1 origin ${{ github.event.pull_request.base.sha }}
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd #v3.0.1
         with:
-          extra_args: "--files $CHANGED_FILES"
+          extra_args: >-
+            --from-ref ${{ github.event.pull_request.base.sha }}
+            --to-ref HEAD