From 6af5f873f58b3a762611a603f337db675295f671 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Thu, 13 Aug 2026 09:26:09 +0200
Subject: [PATCH] Say whether the dependency review had anything to review
 (#62)

A green tick from the dependency-review job had two causes and reported them
identically. A manifest changed and carried no advisory, and no manifest
changed at all, both arrive as success with an empty group. On #129, which
changed no manifest, the job printed that group and no sentence saying which of
the two it was, so a reader is told the dependencies were reviewed when nothing
was submitted for review.

The job now says what it was handed, before the action runs so that the
sentence reaches the log whichever way the review goes. It lists the files this
repository declares a dependency graph in, compares the merge commit against
the base the change would land on, and prints which of the two cases the run
is. The pathspecs are one array read by both commands, so the set it reports
and the set it compares cannot drift apart.

The checkout takes two commits rather than one, which is what makes the first
parent of the merge commit available to compare against. Nothing else in the
job reads history.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 .github/workflows/dependency-review.yml | 38 +++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 591497e..814a966 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -27,6 +27,44 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # Two commits rather than the default one. A pull request checks out
+          # the merge commit, so its first parent is the base the change would
+          # land on, and the step below is a comparison between the two. Nothing
+          # else in this job reads history.
+          fetch-depth: 2
+
+      - name: Say whether there is a dependency change to review
+        # A green tick from the step below has two causes and reports them
+        # identically: a manifest changed and carried no advisory, or no
+        # manifest changed at all. The second is the ordinary case here, and on
+        # a change that touched no manifest the review printed an empty group
+        # and no sentence saying that is what it was. A reader is then told the
+        # dependencies were reviewed when nothing was submitted for review.
+        #
+        # The action decides advisories and this step says what it was handed,
+        # which is why the line is printed around it rather than inside it. It
+        # runs first so that the sentence reaches the log whichever way the
+        # review goes, and a run that refuses says what it refused over.
+        #
+        # The pathspecs are written once and both commands read the same array,
+        # so the set this step reports and the set it compares cannot drift
+        # apart. They are the files the toolchain builds a dependency graph
+        # from, at any depth, so a second module arriving under this root is
+        # read rather than missed.
+        run: |
+          set -euo pipefail
+          graph=(':(glob)**/go.mod' ':(glob)**/go.sum')
+          echo "the dependency graph of this repository is declared in:"
+          git ls-files -- "${graph[@]}"
+          changed=$(git diff --name-only HEAD^1 HEAD -- "${graph[@]}")
+          if [ -n "$changed" ]; then
+            echo "this pull request changes:"
+            echo "$changed"
+            echo "so the review below has a dependency change to compare against the advisory database."
+          else
+            echo "this pull request changes none of them, so the review below has no dependency change to compare and a green result from it means no change was submitted rather than no advisory was found."
+          fi
+
       - name: Dependency review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with: