fix: changed_files resolved to zero files in the Docker container action (git dubious ownership)

CHANGELOG.md

@@ -8,6 +8,36 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Fixed
+- `changed_files` diff-only mode always resolved to zero files in the pre-built
+  Docker GitHub Action: the container runs as root while the checkout is owned
+  by the runner user, so git's ownership check refused every diff lookup, the
+  scope silently resolved to nothing, and the scanners skipped with a green
+  run. Git subprocesses now mark the scan workspace as `safe.directory` via
+  command-scope `GIT_CONFIG_*` environment entries. No config files are
+  touched, and caller-provided `GIT_CONFIG_*` entries (including the previously
+  documented workaround) are preserved. The same mismatch broke git-based
+  repository/branch/commit and default-branch discovery in local Docker runs;
+  those lookups are covered by the same change.
+- A failed `changed_files` diff resolution is no longer indistinguishable from
+  an empty diff. Git errors are captured and logged instead of discarded, and
+  when the scope cannot be resolved — unreadable repository, unresolvable base
+  ref, or `pr` mode with no base ref — Socket Basics now **fails with a
+  configuration error** rather than reporting a green run that scanned nothing.
+  Shallow checkouts get a more specific error naming `fetch-depth: 0`. A
+  genuinely empty diff (e.g. a delete-only PR) is a successful resolution and
+  still skips the scanners as before.
+
+### Added
+- The resolved `changed_files` scope is now logged on every scoped run: file
+  count at INFO, the full file list at DEBUG — so an empty diff and a failed
+  lookup are visible and distinguishable in run logs.
+- `scan_all` is now a declared action input and doubles as the fail-open escape
+  hatch for `changed_files`: when the scope cannot be resolved, widen to a
+  full-repo scan with a warning instead of failing. The widening is partial —
+  only scanners that read scan targets widen, while secret and container
+  scanners stay scoped.
+
 ## [3.0.0] - 2026-08-06
 
 Major release: Trivy-backed scanning returns, now built and published through

action.yml

@@ -11,6 +11,7 @@ runs:
     INPUT_WORKSPACE: ${{ inputs.workspace }}
     # Scan scope
     INPUT_CHANGED_FILES: ${{ inputs.changed_files }}
+    INPUT_SCAN_ALL: ${{ inputs.scan_all }}
     INPUT_SCAN_FILES: ${{ inputs.scan_files }}
     # Input mappings for all parameters
     INPUT_ALL_LANGUAGES_ENABLED: ${{ inputs.all_languages_enabled }}
@@ -118,9 +119,21 @@ inputs:
       GITHUB_BASE_REF), or 'current-commit'. For PR/'auto' modes, check out with
       actions/checkout fetch-depth: 0 so the base branch is available. When the
       diff resolves to no existing files (e.g. a delete-only PR) the scanners
-      are skipped rather than scanning the whole repo.
+      are skipped rather than scanning the whole repo. When the diff cannot be
+      resolved at all (unreadable repo, missing base ref) the run fails with a
+      configuration error instead of reporting a green scan of nothing; set
+      scan_all to widen to a full-repo scan in that case instead.
     required: false
     default: ""
+  scan_all:
+    description: >-
+      Scan the entire workspace even when a narrower scope was requested but
+      could not be produced. Acts as the fail-open escape hatch for
+      changed_files: instead of failing when a diff cannot be resolved, widen to
+      a full-repo scan. Note the widening is partial — only scanners that read
+      scan targets widen, while secret and container scanners stay scoped.
+    required: false
+    default: "false"
   scan_files:
     description: >-
       Explicit comma-separated list of files to scan. Scopes SAST/OpenGrep,

docs/github-action.md

@@ -324,6 +324,40 @@ jobs:
 > nothing rather than falling back to the whole repo. To scan an explicit file
 > list regardless of git state, use the `scan_files` input instead.
 
+> [!NOTE]
+> **When the diff cannot be resolved** — the checkout is unreadable, or the base
+> branch is missing (most commonly a shallow clone without `fetch-depth: 0`) —
+> Socket Basics **fails with a configuration error** naming the underlying git
+> error. It does not scan.
+>
+> This is deliberate. Diff-only scoping is an explicit instruction, and if it
+> cannot be honored there is no honest result to report:
+>
+> - **Skipping the scanners** would exit green having scanned zero files. A
+>   passing check that inspected nothing is worse than a failing one, and a
+>   warning buried in a run log is not something anyone acts on.
+> - **Silently scanning everything** would do the expensive thing on every PR —
+>   precisely what asking for a diff scope was avoiding. On a large repository
+>   that is a slow or OOM-prone check, and it reports **pre-existing** findings
+>   rather than the PR's own, so a checkout misconfiguration surfaces as large PR
+>   comments on every PR until corrected.
+>
+> If the error appears on **every** PR, the cause is almost always a missing
+> `fetch-depth: 0` — fix the checkout rather than sizing up the runner. Shallow
+> checkouts get a more specific error naming that fix directly, including the
+> `no merge base` shape where the base tip was fetched without connecting
+> history.
+>
+> **To scan anyway, set `scan_all: true`.** That widens an unresolvable scope to
+> a full-repository scan with a warning instead of failing. Note the widening is
+> partial: only scanners that read scan targets widen, while secret and container
+> scanners stay scoped.
+>
+> A genuinely *empty* diff (e.g. a delete-only PR) is a successful resolution and
+> still skips the scanners — only a **failed** resolution errors. The resolved
+> file count is logged on every scoped run, so an empty diff and a failed lookup
+> are always distinguishable in the logs.
+
 ## PR Comment Customization
 
 Socket Basics automatically posts enhanced PR comments with **smart defaults that work out of the box** — clickable file links, collapsible sections, syntax highlighting, CVE links, CVSS scores, and auto-labels are all enabled by default.

docs/parameters.md

@@ -120,6 +120,24 @@ PR), the scanners are skipped rather than falling back to scanning the whole
 repository. For PR/`auto`/`pr` modes, check out with full history (e.g.
 `actions/checkout` with `fetch-depth: 0`) so the base branch is available.
 
+If the diff **cannot be resolved** — unreadable repository, missing base ref, or
+a shallow checkout with no base to diff against — the run **fails with a
+configuration error** naming the underlying git error, and nothing is scanned.
+Neither alternative is honest: skipping the scanners exits green having scanned
+zero files, and widening to the whole repository does the expensive thing on
+every PR, which is what requesting a diff scope was avoiding. Shallow checkouts
+get a more specific error naming `fetch-depth: 0`, covering both the missing-ref
+and disconnected-history (`no merge base`) shapes.
+
+Set **`scan_all`** to widen instead of failing: an unresolvable scope then falls
+back to a full-workspace scan with a warning. The widening is partial — only
+scanners that read scan targets widen, while secret and container scanners stay
+scoped to `changed_files`.
+
+The resolved scope is logged on every run (file count at INFO, full file list
+at DEBUG), so an empty diff and a failed lookup are distinguishable in run
+logs.
+
 **Example:**
 ```bash
 socket-basics --changed-files auto