perf: --single-branch upstream clone (follow-up to #19 review)

[LukasParke]

Follow-up to the review feedback on #19, which merged before the fix landed on the branch.

• scripts/upstream now clones the upstream reference --single-branch: the CI clone is ephemeral, so fetching the full ref namespace every run roughly doubled clone time for nothing.
• Goes one step beyond the suggestion: with --single-branch, a --ref not reachable from the default branch (e.g. a manual run against a feature branch) would stop resolving — rev-parse now falls back to an explicit git fetch origin <ref> before failing.

🤖 Generated with Claude Code

[LukasParke]

@devin please review this PR — head is 7e51d313. (Slack ping earlier today did not get picked up, so tagging here as a fallback.)

[perry-the-pr-reviewer]

Perry's Review

Verdict: 💬 Comments / questions

Re-review on 7e51d31 (previous review was a COMMENT on a81fec6). The maintainer app is not installed on this repo, so I cannot post an APPROVE. This is an LGTM — the code is correct and CI is green.

Review details

Change summary

Two targeted changes to the upstream wrapper script:

1. --single-branch on fresh clone — In CI, the upstream checkout is ephemeral (not persisted between runs), so the existing-clone path (fetch with all tags) is never taken. Fetching the full ref namespace every run roughly doubles clone time for nothing, since the script only targets origin/HEAD or a release tag reachable from the default branch. --single-branch fetches only the default branch and its reachable history (including reachable tags).

2. Fallback fetch for unresolvable refs — With --single-branch, a ref not reachable from the default branch (e.g. a manual --ref against a feature branch or an unreachable tag) won't be in the local clone. The new if-guard checks resolution with rev-parse --quiet --verify --end-of-options, and falls back to an explicit git fetch origin plus FETCH_HEAD. The --end-of-options / -- pair prevents a ref starting with a dash from being parsed as an option (CI refs start with @, but manual runs take anything).

Analysis

Verified empirically with a test repo:

• --single-branch fetches tags reachable from the default branch (e.g. v1.0.0 on main resolves locally).
• Tags NOT reachable from the default branch (e.g. v2.0.0 on a feature branch) do NOT resolve — correctly triggers the fallback fetch, which then resolves via FETCH_HEAD.
• origin/HEAD resolves in a --single-branch clone (the else branch for no --ref).
• The existing-clone path (local dev) is unaffected: it still does a full fetch with all tags, so the fallback is a no-op there.

Error handling is correct under set -euo pipefail: if the fallback fetch fails (ref truly doesn't exist on the remote), the script exits cleanly with a git error message.

CI

Both checks pass: check (19s), verify-port (22s).

[LukasParke]

@devin review — second request. Slack pings at ~10:52 and ~10:56 CDT and a GitHub mention at ~11:19 have all gone unanswered on this PR, and Perry has since reviewed the current head. Flagging explicitly rather than letting it sit silent.

[LukasParke]

Correction to my earlier ping — withdrawing the escalation.

Devin is not unresponsive here; it is not installed on this repo. Checked the last 20 PRs in each: zero Devin reviews on python-agent, go-agent, and agent-monorepo, versus 18 across the last 10 PRs on openrouter-web and 21 on typescript-agent. Perry is installed on all three. Devin was also actively posting in #agents at 12:07 today, so it is up — the app simply is not on these repos.

That makes Perry-at-head the complete automated coverage available here, not a partial pass waiting on a second reviewer. Apologies for the noise from the repeat @devin mentions.

If Devin coverage on these repos is wanted, that is a one-time GitHub App install rather than anything to do on this PR.