[quality] FOSSA policy test fails on PRs whose base commit was never analyzed (fossa test --diff) #613

Finding

FOSSA license scan (added in #608) goes red on pull requests whose base commit was never analyzed in FOSSA, independent of the PR's own diff.

The PR job runs fossa test --project hivecommons/docs --diff ${{ github.event.pull_request.base.sha }}. --diff asks FOSSA to compare against a revision it already holds, and fails hard when it does not:

diffing against revision: `5a8f45a1521a4b83c6b3d2eafdf62820a9f22f68`
Error: Revision for locator (custom+162/hivecommons/docs$5a8f45a…) was not found. Please ensure provided project and revision exists in FOSSA org
##[error]Error: The process '/opt/hostedtoolcache/fossa/3.20.10/linux_amd64/fossa' failed with exit code 1

Why 5a8f45a (the #608 merge itself) was never uploaded: its push-to-main run (run 2, 01:39Z) executed before FOSSA_API_KEY was configured, so both FOSSA steps were skipped. Every PR based on that commit then failed the policy test:

• run 3 — bot/hive-docs-refresh, failure
• run 4 — 📖 docs: add crux-lanes.md to hive sync list #611, failure (merged red)

run 6 passed only because main had moved to 5308a7b, whose analyze (run 5) finished 21 s before the PR's test step ran.

The same failure recurs, with no diff at fault, whenever:

1. a base commit's main analyze was skipped or failed (secret rotation, FOSSA outage, cancelled run), or
2. a PR run starts within ~40 s of its base landing on main — exactly what update-branch after a merge, or a quick rebase-and-push, produces.

The check is currently informational (tide merged #611 with it red), so the cost is noise and a misleading red X on hive-opened PRs; if it is ever made required it becomes a merge blocker that only a push to main can clear.

Recommendation

Replace the Run FOSSA policy test step in .github/workflows/fossa.yml with a run: step that keeps the diff-against-base behaviour but falls back to a full policy test when FOSSA reports the base revision as unknown. fossa-action installs the CLI via @actions/tool-cache and core.addPath, so fossa is on PATH for later steps in the same job. Exact replacement (the two fossa test invocations are the only commands; everything else is the guard):

      # `fossa test --diff` needs the base revision to exist in FOSSA. It does
      # not when the base merged while FOSSA_API_KEY was unset, when its
      # main-branch analyze failed, or when this run starts before that
      # analyze finishes. In those cases fall back to a full policy test
      # instead of failing on a revision this PR did not produce.
      - name: Run FOSSA policy test
        if: env.FOSSA_API_KEY != '' && github.event_name == 'pull_request'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        shell: bash
        run: |
          set -o pipefail
          log="$(mktemp)"
          if fossa test --project hivecommons/docs --diff "$BASE_SHA" 2>&1 | tee "$log"; then
            exit 0
          fi
          if grep -q "Revision for locator" "$log"; then
            echo "FOSSA has no analysis for base $BASE_SHA; ran the full policy test instead of a diff." >> "$GITHUB_STEP_SUMMARY"
            exec fossa test --project hivecommons/docs
          fi
          exit 1

This replaces the second uses: fossas/fossa-action@29693cc… block (the one with run-tests: true / test-diff-revision:); the analyze step above it is unchanged. A genuine licence-policy violation still fails both invocations; only the "base revision unknown" case changes outcome.

• .github/workflows/fossa.yml: policy-test step falls back to a full fossa test when the base revision is not in FOSSA

Why this is an issue and not a PR

This agent's App token is minted without the workflows permission, so any push touching .github/workflows/** is rejected server-side. The change needs a human or an ISSUES_PRS_MERGE-tier agent to land; the replacement text above is intended to be applied verbatim.

Priority

• Impact: medium (red check on PRs with no diff at fault; becomes a merge blocker if the check is ever required)
• Effort: low

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 53a46ad

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88