fix(ci): skip the diff-based audits on branch creation instead of guessing a base

.github/workflows/test-build.yml

@@ -14,18 +14,8 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      # The diff-based audits below need a base commit to read, and the default
-      # depth of 1 clones a single commit with no parent. They normally fetch
-      # their base by SHA (see "Resolve base ref"), so this depth only covers the
-      # `HEAD~1` fallback — but without it that fallback resolves to nothing.
-      #
-      # Worth stating because the failure was invisible for so long: the migration
-      # audit read the resulting `git diff` failure as "no migrations changed" and
-      # exited 0, so it had never actually run on a push build.
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          fetch-depth: 2
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -114,39 +104,43 @@ jobs:
 
           echo "✅ All env flags are properly configured"
 
-      # One fetch for both base-ref audits, and no `|| true`: a swallowed fetch leaves
-      # the base ref absent, which neither audit can tell apart from a branch that
-      # changed nothing. The block-registry check at least degrades to a visible
-      # `⚠ … skipping` line; the migration audit printed `✓ No new migrations to
-      # check` and exited 0, clearing the only guard on production DDL.
-      #
-      # Depth stays at 1 — without a merge-base the migration audit diffs the two
-      # tips, which under `--diff-filter=AM` is exactly the migrations new here.
       # Resolved once for both diff-based audits, and never with `|| true`: a
       # swallowed fetch leaves the base absent, which neither audit can tell apart
-      # from a branch that changed nothing.
+      # from a branch that changed nothing. That is how the migration audit came
+      # to print `✓ No new migrations to check` and exit 0 on every push build,
+      # having read nothing — and it is the only guard on production DDL.
       #
       # On push the base is `github.event.before`, the tip the branch had before
-      # this push — not `HEAD~1`, which names only the last commit and would let a
-      # multi-commit push slip every earlier commit's migrations past the audit.
-      # It is fetched by SHA at depth 1; the audits diff two tips and need no
-      # common ancestry. An all-zero `before` means the branch is new and has no
-      # predecessor to diff, so `HEAD~1` remains the fallback there.
+      # this push. It is fetched by SHA at depth 1, so the checkout needs no extra
+      # history; the audits diff two tips and need no common ancestry between them.
+      #
+      # A push that creates the branch reports an all-zero `before` and genuinely
+      # has no predecessor, so the audits skip with a notice rather than falling
+      # back to a commit. Auditing one commit while reporting on the whole push is
+      # the failure this step exists to remove.
       - name: Resolve base ref for diff-based audits
         id: audit_base
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             git fetch --depth=1 origin "${{ github.base_ref }}"
             echo "ref=origin/${{ github.base_ref }}" >> "$GITHUB_OUTPUT"
-          elif [ -n "${{ github.event.before }}" ] &&
-               [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then
+          elif [ -z "${{ github.event.before }}" ] ||
+               [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+            # No predecessor to diff against. All-zero means the push created the
+            # branch; empty means this was not a push at all — `workflow_dispatch`
+            # carries no push payload, and dropping that guard would run
+            # `git fetch origin ""` and fail the job. Say so and let the audits
+            # skip: naming a commit here would audit that one commit while
+            # reporting on the whole push.
+            echo "::notice::No preceding commit to diff against; skipping the diff-based audits."
+            echo "ref=" >> "$GITHUB_OUTPUT"
+          else
             git fetch --depth=1 origin "${{ github.event.before }}"
             echo "ref=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "ref=HEAD~1" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Check block registry invariants
+        if: steps.audit_base.outputs.ref != ''
         run: bun run apps/sim/scripts/check-block-registry.ts "${{ steps.audit_base.outputs.ref }}"
 
       - name: Lint code
@@ -162,6 +156,7 @@ jobs:
         run: bun run docs-manifest:check
 
       - name: Migration safety (zero-downtime) audit
+        if: steps.audit_base.outputs.ref != ''
         run: bun run check:migrations "${{ steps.audit_base.outputs.ref }}"
 
       # Every workspace, not just realtime. packages/emcn, packages/utils,