Harden PR branch checkout against missing .git and lock in checkout: false behavior

[Copilot]

PR-triggered workflows could fail before the agent started in two cases: when the PR checkout helper ran after workspace git metadata had been removed, and when checkout: false was combined with PR triggers without an explicit regression covering that path. This change hardens the helper for the first case and locks in the intended compiler behavior for the second.

• Runtime: recover when workspace git metadata is gone

  • checkout_pr_branch.cjs now detects a missing .git directory before running fetch/checkout logic.
  • When absent, it bootstraps a minimal local git repo, restores origin, and reconfigures local auth so the existing PR fetch path can proceed.
  • This keeps the current checkout strategy intact and only adds recovery for workflows where an earlier step has wiped repository metadata.

• Compiler regression coverage: pull_request + checkout: false

  • Added coverage to ensure PR workflows with checkout: false do not emit the Checkout PR branch helper step.
  • This makes the unsupported/accidental combination visible in tests and protects against future regressions.

• Helper test coverage

  • Added a focused JS test for the missing-.git recovery path.
  • Updated existing helper tests to reflect the helper’s remote/bootstrap preflight sequence.

if (!fs.existsSync(path.join(workspaceRoot, ".git"))) {
  await exec.exec("git", ["init"]);
}

try {
  await exec.exec("git", ["remote", "set-url", "origin", remoteUrl]);
} catch {
  await exec.exec("git", ["remote", "add", "origin", remoteUrl]);
}

• Fixes checkout: false aborts with 'not a git repository' on PR triggers; pull_request_target also racey with microsoft/apm-action #30791

[github-actions]

Hey @Copilot 👋 — great work on hardening the PR branch checkout logic! This is a well-scoped fix that addresses the critical issues in #30791 where PR-triggered workflows could fail before the agent even started.

What looks good:

• ✅ Runtime recovery — the missing-.git detection and lazy git re-initialization is a clean recovery path that keeps the existing checkout strategy intact and only adds fallback logic for edge cases like microsoft/apm-action wiping workspace metadata.
• ✅ Compiler regression lock-in — new test case ensures pull_request + checkout: false will never slip through without triggering a test failure, protecting against future regressions.
• ✅ Test coverage — both the JS helper test (for the recovery path) and Go compiler test (for the unsupported combination) are focused and well-targeted.
• ✅ Clear description — the PR body breaks down exactly what was fixed and why, with a code snippet for reference.

This PR looks ready for review!

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · auto · 55.1 AIC · ⌖ 4.76 AIC · ⊞ 8.8K · ◷