ci: Compare against HEAD instead of working tree

When we list modified files we should only check the commits that are
being added or are under review. Therefore we should use the format `git
diff <commit> <commit>`. Using `git diff <commit>` will diff <commit>
against the current working tree, which is only correct if the working
tree is pristine.

TARGET_BRANCH doesn't have to be limited to being a branch, it can be
any kind of git revision.

Finally instead of hard coding `master`, we use the `event.before` which
has the tip of the branch before the push event.

Author: NickeZ

.ci/check-pep8

@@ -11,7 +11,7 @@ set -o pipefail
 command -v git >/dev/null 2>&1 || { echo >&2 "git is missing"; exit 1; }
 
 # grep will exit with 1 if no lines are found
-FILES=$(git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} | grep -v -e "old/" -e "generated/" -e "rust/vendor/" | grep -E ".py\$" || exit 0)
+FILES=$(git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} HEAD | grep -v -e "old/" -e "generated/" -e "rust/vendor/" | grep -E ".py\$" || exit 0)
 if [ -z "${FILES}" ] ; then
        exit 0
 fi

.ci/check-style

@@ -25,10 +25,10 @@ if test -t 1; then
 	fi
 fi
 
-if git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} | grep -v -E "(^src/(rust|ui/fonts)|.*ugui.*|.*base32.*)" | grep -E "^(src|test)" | grep -E "\.(c|h)\$" | xargs -n1 "$CLANGFORMAT" -output-replacements-xml | grep -c "<replacement " >/dev/null; then
+if git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} HEAD | grep -v -E "(^src/(rust|ui/fonts)|.*ugui.*|.*base32.*)" | grep -E "^(src|test)" | grep -E "\.(c|h)\$" | xargs -n1 "$CLANGFORMAT" -output-replacements-xml | grep -c "<replacement " >/dev/null; then
 	echo -e "${red}Not $CLANGFORMAT clean${normal}"
 	# Apply CF to the files
-	git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} | grep -v -E "(^src/(rust|ui/fonts)|.*ugui.*|.*base32.*)" | grep -E "^(src|test)" | grep -E "\.(c|h)\$" | xargs -n1 "$CLANGFORMAT" -i
+	git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} HEAD | grep -v -E "(^src/(rust|ui/fonts)|.*ugui.*|.*base32.*)" | grep -E "^(src|test)" | grep -E "\.(c|h)\$" | xargs -n1 "$CLANGFORMAT" -i
 	# Print list of files that weren't formatted correctly
 	echo -e "Incorrectly formatted files:"
 	git --no-pager diff --name-only

.ci/check-tidy

@@ -36,7 +36,7 @@ for dir in build build-build; do
 	        s/-Wno-cast-function-type//g; s/-mfpu=fpv4-sp-d16//g; s/-Wformat-signedness//g' ${dir}/compile_commands.json
 
 	# Only check our files
-	SOURCES1=$(git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} |\
+	SOURCES1=$(git --no-pager diff --diff-filter=d --name-only ${TARGET_BRANCH} HEAD |\
 		grep -v -E "(^src/(drivers|ui/fonts)|.*ugui.*|.*base32.*)" |\
 		grep -E "^(src)" |\
 		grep -v "^test/unit-test/u2f/" |\

.ci/run-container-ci

@@ -18,9 +18,8 @@
 # It accepts two positional arguments:
 # 1. A workspace dir, the root of the git repo clone, or "pull" literal.
 #    In the latter case, CI container image is pulled from a registry.
-# 2. An optional target branch for code style diffs. Defaults to "master" for
-#    push commits and overwritten with TRAVIS_BRANCH env var for pull requests
-#    when run on Travis CI.
+# 2. A git revision (see man gitrevisions) to compare against HEAD to filter out modified and new
+#    files. Some scripts only run on that subset.
 
 set -e
 set -x
@@ -40,9 +39,7 @@ if [ -z "${WORKSPACE_DIR}" ]; then
   exit 1
 fi
 
-TARGET_BRANCH="${2:-master}"
-TARGET_BRANCH=origin/${TARGET_BRANCH}
-
+TARGET_BRANCH="$2"
 # The safe.directory config is so that git commands work. even though the repo folder mounted in
 # Docker is owned by root, which can be different from the owner on the host.
 docker run -e TARGET_BRANCH="${TARGET_BRANCH}" \

.github/workflows/ci.yml

@@ -20,4 +20,4 @@ jobs:
       - name: Pull CI container image
         run: ./.ci/run-container-ci pull
       - name: Run CI in container
-        run: ./.ci/run-container-ci ${{github.workspace}}
+        run: ./.ci/run-container-ci ${{github.workspace}} ${{ github.event.before }}

.github/workflows/pr-ci.yml

@@ -18,7 +18,7 @@ jobs:
         run: ./.ci/run-container-ci pull
 
       - name: Run CI in container
-        run: ./.ci/run-container-ci ${{github.workspace}} ${{ github.base_ref }}
+        run: ./.ci/run-container-ci ${{github.workspace}} ${{ github.event.pull_request.base.sha }}
 
   # Generate a list of commits to run CI on
   generate-matrix:
@@ -35,7 +35,7 @@ jobs:
       - name: Create jobs for commits in PR history
         id: set-matrix
         run: |
-          echo matrix=$(.ci/matrix-from-commit-log origin/${{github.base_ref}}..${{ github.event.pull_request.head.sha}}~) >> $GITHUB_OUTPUT
+          echo matrix=$(.ci/matrix-from-commit-log ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}~) >> $GITHUB_OUTPUT
 
   # Run this job for every commit in the PR except HEAD.
   pr-commit-ci:
@@ -70,4 +70,4 @@ jobs:
         run: ./.ci/run-container-ci pull
 
       - name: Run CI in container
-        run: ./.ci/run-container-ci ${{github.workspace}} ${{ github.base_ref }}
+        run: ./.ci/run-container-ci ${{github.workspace}} ${{ github.event.pull_request.base.sha }}