From 79e9ba8357f8352137f51fb28914f53f368b0698 Mon Sep 17 00:00:00 2001
From: liamcrumm <14815298+liamcrumm@users.noreply.github.com>
Date: Tue, 4 Aug 2026 23:13:54 +0000
Subject: [PATCH] fix(ci): scope markdown-link-check to the PR's merge base

`check-modified-files-only` runs `git diff --name-only <base-branch>`, a
two-dot diff against the base tip. On a branch that has fallen behind main,
every commit that landed on main since the branch point is reported as
modified, so the job checks files the PR never touched and fails on links
that were already fixed upstream.

Measured on #3450 (55 commits behind, one changed .md file): the job checked
255 markdown files and failed on four links that #3352 had already fixed on
main. All ten PRs currently failing this check are behind main, by 14 to 269
commits.

Resolve the base to its merge base with HEAD so the diff covers only what the
branch actually changed. Non-pull-request events keep the previous behaviour.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: liamcrumm <14815298+liamcrumm@users.noreply.github.com>
---
 .github/workflows/ci.yml | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2657dacd4..ce0f989cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -992,6 +992,31 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
+      # `check-modified-files-only` runs `git diff --name-only <base-branch>`, a
+      # two-dot diff against the base *tip*. On a branch that has fallen behind,
+      # every commit that landed on the base since the branch point is reported
+      # as modified, so the job checks hundreds of files the PR never touched and
+      # fails on links that were already fixed upstream. Resolving the base to
+      # its merge base with HEAD restores the intended "files this PR changed"
+      # scope.
+      - name: Resolve merge base for changed-file scoping
+        id: linkbase
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -e
+          if [ -z "$BASE_REF" ]; then
+            # Not a pull request (schedule/push): keep the previous behaviour.
+            echo "ref=main" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git fetch --no-tags origin "$BASE_REF"
+          if BASE_SHA=$(git merge-base "origin/$BASE_REF" HEAD); then
+            echo "ref=$BASE_SHA" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::cannot resolve merge base with $BASE_REF; using its tip"
+            echo "ref=origin/$BASE_REF" >> "$GITHUB_OUTPUT"
+          fi
       - name: Markdown link check
         uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
         with:
@@ -1001,7 +1026,7 @@ jobs:
           # Only check links in files changed by the PR/push to avoid
           # pre-existing broken links blocking unrelated work.
           check-modified-files-only: 'yes'
-          base-branch: main
+          base-branch: ${{ steps.linkbase.outputs.ref }}
 
   # ── Workflow security audit (only when workflows change) ─────────────
   workflow-security: