From cae7f826b39b38e7d49a90d342499234dec007bf Mon Sep 17 00:00:00 2001
From: Will Pfleger <pfleger.will@gmail.com>
Date: Tue, 25 Aug 2026 18:50:47 -0400
Subject: [PATCH] fix(ci): check out source in docker.yml merge job (#6833)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

Every `docker.yml` run on `main` has failed since
[#6781](https://github.com/block/buzz/pull/6781) merged. That PR added a
"Create deployment eligibility predicate" step to the `merge` job, which
runs `jq` against
`$GITHUB_WORKSPACE/scripts/create-deployment-eligibility-predicate.jq`.
But the `merge` job has no `actions/checkout` step — the workspace is
empty, so `jq` can't open the file and exits `2` (`jq: Could not open
... No such file or directory`). The `build` and `qualify` jobs each
check out the source; `merge` never needed one until this step was
added.

## Fix

- `.github/workflows/docker.yml`: add `actions/checkout` (same pinned
SHA as the other jobs, `df4cb1c` / v6.0.3) as the first step of the
`merge` job.
- `scripts/test-relay-image-eligibility-workflow.sh`: guard the
regression by asserting the `merge` job checks out the source before
building the predicate.

## Verification

CI cannot exercise the `merge` job on a pull request — the job is gated
`if: github.event_name != 'pull_request'`, so it only runs on push to
`main`. The proof is the root cause (missing checkout for a step that
reads a repo file) plus the eligibility workflow test:
`scripts/test-relay-image-eligibility-workflow.sh` passes with the fix
and fails with the new guard's specific message (`merge job must check
out the source before building the eligibility predicate`) when the
checkout is removed.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
---
 .github/workflows/docker.yml                     | 5 +++++
 scripts/test-relay-image-eligibility-workflow.sh | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ddb55f8542..f48f1bc92f 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -330,6 +330,11 @@ jobs:
             tag_prefix: debug-
 
     steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Download all per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
diff --git a/scripts/test-relay-image-eligibility-workflow.sh b/scripts/test-relay-image-eligibility-workflow.sh
index 168f9d3689..40745a8e88 100755
--- a/scripts/test-relay-image-eligibility-workflow.sh
+++ b/scripts/test-relay-image-eligibility-workflow.sh
@@ -35,6 +35,15 @@ if grep -Fq "buzz-staging-dev" "$workflow"; then
   exit 1
 fi
 
+# The merge job reads scripts/create-deployment-eligibility-predicate.jq from the
+# workspace, so it must check out the source first. Guard against the checkout being
+# dropped from that job (the workspace is otherwise empty and jq exits non-zero).
+merge_job=$(awk '/^  merge:/{f=1} f&&/^  [a-z][a-z_-]*:$/&&!/^  merge:/{exit} f' "$workflow")
+grep -Fq "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" <<<"$merge_job" || {
+  echo "merge job must check out the source before building the eligibility predicate" >&2
+  exit 1
+}
+
 select_run() {
   jq -r --arg source_sha aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa -f "$selector" | jq -r '.id // empty'
 }