From 4a0af3c374b7750c265f505f3f2964165436bafe Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Thu, 11 Jun 2026 09:33:21 +0200 Subject: [PATCH 1/2] Use action-checkout-and-setup with skip-install in check-release The check-release composite action invokes `yarn workspaces list` but never sets up the project's pinned Yarn version, so the runner's global Yarn 1.22.22 is used and rejected against the `packageManager` pin of `yarn@4.16.0`. Use `MetaMask/action-checkout-and-setup@v3` with the new `skip-install: true` input (added in v3.4.0) so Node and Yarn are set up via Corepack without paying the cost of `yarn install`, which this action does not need. --- .github/actions/check-release/action.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml index 186eaa7583..222c9cfcf5 100644 --- a/.github/actions/check-release/action.yml +++ b/.github/actions/check-release/action.yml @@ -9,10 +9,12 @@ inputs: runs: using: composite steps: - - name: Checkout repository - uses: actions/checkout@v5 + - name: Checkout and setup environment + uses: MetaMask/action-checkout-and-setup@v3 with: + is-high-risk-environment: false fetch-depth: 0 + skip-install: true - name: Get merge base id: merge-base From f178d7620f211525fd337a1c2e5a7026b0e3ea76 Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Thu, 11 Jun 2026 12:40:50 +0200 Subject: [PATCH 2/2] Use fetch-depth 0 in check-release parent workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `MetaMask/action-checkout-and-setup` only re-checks out when `.git` does not exist. Since the parent workflow's checkout creates `.git` first (required so GitHub can locate `./.github/actions/check-release`), the composite action's checkout was being skipped — leaving the runner with only the parent's shallow `fetch-depth: 1`. As a result, `refs/remotes/origin/main` was never fetched and `git merge-base` failed. Set `fetch-depth: 0` on the parent's checkout and drop the now-no-op `fetch-depth: 0` from the composite. --- .github/actions/check-release/action.yml | 1 - .github/workflows/main.yml | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml index 222c9cfcf5..d522952937 100644 --- a/.github/actions/check-release/action.yml +++ b/.github/actions/check-release/action.yml @@ -13,7 +13,6 @@ runs: uses: MetaMask/action-checkout-and-setup@v3 with: is-high-risk-environment: false - fetch-depth: 0 skip-install: true - name: Get merge base diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 781af33ae7..b80e1f0939 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -87,6 +87,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v5 + with: + fetch-depth: 0 - name: Check release if: github.event_name != 'push' uses: ./.github/actions/check-release