fix(action): Resolve any branch in a private repository

[aywrite]

What changed

The workflows check out with persist-credentials: false, so a later git fetch has no credentials. A public repository answers the fetch anyway. A private one refuses it.

bin/resolve_ref.sh fetched any branch other than the one checked out, by name. So in a private repository, naming another branch as the candidate or baseline failed with could not read Username for 'https://github.com'.

A full checkout already has every branch as origin/<name>. The script now looks there before it fetches.

In a private repository these still need a fetch, and still fail:

• a pull request number (its head is under refs/pull/, which a checkout does not fetch)
• a commit that is on no branch or tag

Fixing those means handing the token to that one fetch. It would have to stay out of the step that runs the caller's build. That changes how the workflows handle credentials, so it is not part of this PR.

Docs:

• actions/resolve-ref/README.md has a section saying which refs resolve in a private repository.
• The quickstart's requirements tell a private repository to use tags, commits and the branch it runs from for now. That also holds for v0.6.0, which the quickstart pins and which lacks this fix.

How it was checked

• I cloned the repository with the refspecs a full checkout uses and pointed origin at a private repository's URL.
  • Before the change, another branch failed with could not read Username. After it, the branch resolves.
  • A pull request number still fails the same way.
  • A tag and the checked-out branch resolve either way.
• New tests in tests/test_resolve.py do the same against an origin that cannot be reached:
  • a branch that is not checked out resolves
  • a tag and a commit still resolve
  • a pull request number and an unknown branch still fail
• The branch test fails without the change.
• python3 -m pytest tests passes (424 tests), and pre-commit run --all-files is clean.

The workflows call this script through the pinned resolve-ref action. So callers get the fix with the next release, and no workflow change is needed.

🤖 Generated with Claude Code

https://claude.ai/code/session_018ccJFsmZ4jAKYmFNgNBh9u

---

Generated by Claude Code