From a81fec68085f7b16923ff00c889e75c1cc78c59a Mon Sep 17 00:00:00 2001
From: Luke Parke <5702154+LukasParke@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:22:58 -0500
Subject: [PATCH 1/2] perf(upstream): clone upstream --single-branch, with a
 fetch fallback for out-of-branch refs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the review suggestion on #19: the CI clone is ephemeral, so
fetching the full ref namespace every run roughly doubles clone time for
nothing — the script targets origin/HEAD or a release tag, both reachable
from the default branch.

Goes one step beyond the suggestion: with --single-branch, a --ref that
is NOT reachable from the default branch (e.g. a manual run against a
feature branch) would no longer resolve, so rev-parse now falls back to
an explicit fetch of that ref before failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/upstream | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/scripts/upstream b/scripts/upstream
index ce561de..f67206e 100755
--- a/scripts/upstream
+++ b/scripts/upstream
@@ -124,11 +124,19 @@ if [ -d "$upstream_dir/.git" ]; then
   git -C "$upstream_dir" fetch --tags --force origin
 else
   rm -rf "$upstream_dir"
-  git clone "$upstream_url" "$upstream_dir"
+  # --single-branch: CI recreates this clone every run, and fetching the whole
+  # ref namespace roughly doubles clone time for nothing — the script targets
+  # origin/HEAD or a release tag (reachable from the default branch, so still
+  # fetched). Refs outside that (e.g. a manual run against a feature branch)
+  # are handled by the fallback fetch below.
+  git clone --single-branch "$upstream_url" "$upstream_dir"
 fi
 
 if [ -n "$ref" ]; then
-  target_commit="$(git -C "$upstream_dir" rev-parse "$ref^{commit}")"
+  if ! target_commit="$(git -C "$upstream_dir" rev-parse --quiet --verify "$ref^{commit}")"; then
+    git -C "$upstream_dir" fetch origin "$ref"
+    target_commit="$(git -C "$upstream_dir" rev-parse FETCH_HEAD^{commit})"
+  fi
 else
   target_commit="$(git -C "$upstream_dir" rev-parse origin/HEAD 2>/dev/null || git -C "$upstream_dir" rev-parse origin/main)"
 fi

From 7e51d31375de647dad650055e63713d678a72018 Mon Sep 17 00:00:00 2001
From: Luke Parke <5702154+LukasParke@users.noreply.github.com>
Date: Wed, 29 Jul 2026 11:00:32 -0500
Subject: [PATCH 2/2] fix(upstream): guard ref arguments against option
 injection

Same hardening as go-agent#2 review nit: '--' terminator on the fallback
fetch and --end-of-options on rev-parse so a manual --ref value starting
with '-' cannot be parsed as an option.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/upstream | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/upstream b/scripts/upstream
index f67206e..e110791 100755
--- a/scripts/upstream
+++ b/scripts/upstream
@@ -133,8 +133,10 @@ else
 fi
 
 if [ -n "$ref" ]; then
-  if ! target_commit="$(git -C "$upstream_dir" rev-parse --quiet --verify "$ref^{commit}")"; then
-    git -C "$upstream_dir" fetch origin "$ref"
+  # --end-of-options / --: a ref value starting with "-" must not be parsed as
+  # an option (CI refs always start with "@", but manual runs take anything).
+  if ! target_commit="$(git -C "$upstream_dir" rev-parse --quiet --verify --end-of-options "$ref^{commit}")"; then
+    git -C "$upstream_dir" fetch origin -- "$ref"
     target_commit="$(git -C "$upstream_dir" rev-parse FETCH_HEAD^{commit})"
   fi
 else