fix(scripts): surface git-diff failure in selfhost pre-deploy summary (#7787)

The sensitive-path scan read `git diff --name-only` via a process
substitution (`done < <(git diff ...)`), whose exit status is invisible
to `set -euo pipefail`. A diff failure (bad ref, shallow clone, detached
history) left the loop with zero lines, so the script reported "no
historically-sensitive paths touched" -- a false all-clear on a
deploy-safety advisory. Capture the diff via a checked command
substitution and error out loudly if it fails.

Closes #7775

Co-authored-by: jaytbarimbao-collab <300663773+jaytbarimbao-collab@users.noreply.github.com>

Author: jaytbarimbao-collab

scripts/selfhost-pre-deploy-summary.sh

@@ -116,11 +116,19 @@ is_sensitive() {
 }
 
 sensitive_files=()
+# #7775: capture the diff via a CHECKED command substitution rather than `done < <(git diff ...)`. A
+# process-substitution failure (bad ref, shallow clone, detached history) is invisible to `set -e`, so the
+# loop would just see no lines and the script would report "no historically-sensitive paths touched" -- a
+# false all-clear on a deploy-safety advisory. Surface it as a real error instead.
+if ! diff_output="$(git diff --name-only "$range")"; then
+  echo "error: 'git diff --name-only $range' failed; cannot assess historically-sensitive paths" >&2
+  exit 1
+fi
 while IFS= read -r file; do
   if [ -n "$file" ] && is_sensitive "$file"; then
     sensitive_files+=("$file")
   fi
-done < <(git diff --name-only "$range")
+done <<< "$diff_output"
 
 echo ""
 if [ "${#sensitive_files[@]}" -eq 0 ]; then

test/unit/selfhost-pre-deploy-summary-script.test.ts

@@ -224,4 +224,29 @@ describe("selfhost-pre-deploy-summary.sh", () => {
     expect(result.stderr).toContain("is not an ancestor");
     expect(result.stdout).toContain("upstream commit");
   });
+
+  it("surfaces an error instead of a false all-clear when git diff --name-only fails (#7775)", () => {
+    const { base, seedDir, checkoutDir } = createSandbox();
+    // Give origin an incoming commit so the script proceeds past "up to date" to the sensitive-path diff.
+    commitFile(seedDir, "src/incoming.ts", "export const incoming = 1;\n", "incoming commit");
+    git(["push", "-q", "origin", "main"], seedDir);
+
+    // Shadow `git` with a fake that fails ONLY `git diff --name-only ...` (the sensitive-path scan),
+    // delegating every other command -- including fetch and the `git diff --stat` summary -- to real git.
+    const realGit = spawnSync("bash", ["-c", "command -v git"], { encoding: "utf8" }).stdout.trim();
+    const fakeBin = join(base, "fakebin");
+    mkdirSync(fakeBin, { recursive: true });
+    writeFileSync(
+      join(fakeBin, "git"),
+      `#!/usr/bin/env bash\nif [ "$1" = "diff" ] && [ "$2" = "--name-only" ]; then\n  echo "forced diff failure" >&2\n  exit 1\nfi\nexec ${realGit} "$@"\n`,
+      { mode: 0o755 },
+    );
+
+    const result = run(checkoutDir, { PATH: `${fakeBin}:${process.env.PATH ?? ""}` });
+
+    // A failed diff must be reported as a failure, not silently presented as "no sensitive paths touched".
+    expect(result.status, result.stdout + result.stderr).not.toBe(0);
+    expect(result.stderr).toMatch(/git diff.*failed|cannot assess historically-sensitive/i);
+    expect(result.stdout).not.toContain("no historically-sensitive paths touched");
+  });
 });