chore: check undesirable code locally

[zeitlinger]

Changes

Check undesirable code locally

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository: renovate itself

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[zeitlinger]

I think the check for undesirable code can't pass as it expects the script to be present on main

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0 # Fetch all history for comparison
          sparse-checkout: true
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Check for undesirable code
        run: bash ./tools/check-undesirable-code.sh ${{ github.event.pull_request.base.sha }}

[viceice]

I think the check for undesirable code can't pass as it expects the script to be present on main

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0 # Fetch all history for comparison
          sparse-checkout: true
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Check for undesirable code
        run: bash ./tools/check-undesirable-code.sh ${{ github.event.pull_request.base.sha }}

i think you forgot to make it executable?

I wonder why we pass ref and repository to checkout 🤔

[zeitlinger]

I think the check for undesirable code can't pass as it expects the script to be present on main

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0 # Fetch all history for comparison
          sparse-checkout: true
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - name: Check for undesirable code
        run: bash ./tools/check-undesirable-code.sh ${{ github.event.pull_request.base.sha }}

i think you forgot to make it executable?

it should be (755)

git ls-files -s tools/check-undesirable-code.sh
100755 54aae3b5107b524cb3953295a77d8f7582537431 0       tools/check-undesirable-code.sh

I wonder why we pass ref and repository to checkout 🤔

we only pass the branch - so that you can have PRs that don't target main