From 1cc2b9a8f2e977ecc2ca2fdc7bee191a925b30c2 Mon Sep 17 00:00:00 2001
From: Andriy Oblivantsev <eslider@gmail.com>
Date: Sun, 12 Jul 2026 12:54:04 +0100
Subject: [PATCH] fix: fetch PR head SHA after shallow clone in CI

Shallow clone only includes default-branch history; pull_request
runs must fetch the event commit before checkout.
---
 .github/workflows/release.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ba20cd3..7c92f38 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -25,6 +25,7 @@ jobs:
       - name: Checkout
         run: |
           git clone --depth=50 https://${{ gitea.actor }}:${{ gitea.token }}@git.produktor.io/${{ gitea.repository }}.git .
+          git fetch --depth=1 origin ${{ gitea.sha }}
           git checkout ${{ gitea.sha }}
 
       - name: Install dependencies
@@ -62,6 +63,7 @@ jobs:
       - name: Checkout
         run: |
           git clone --depth=1 https://${{ gitea.actor }}:${{ gitea.token }}@git.produktor.io/${{ gitea.repository }}.git .
+          git fetch --depth=1 origin ${{ gitea.sha }}
           git checkout ${{ gitea.sha }}
 
       - name: Install Trivy