fix: check existing refs before trying to fetch inside Docker

The Docker container has no git auth credentials. Instead of trying
to fetch (which silently fails), first check if origin/main already
exists from a workflow pre-step. Only fall back to fetching if no
refs are found, with a clear error message telling users to add a
pre-fetch step.

scripts/review.sh

@@ -73,28 +73,45 @@ echo "::endgroup::"
 # ─── Phase 2: Generate diff ───────────────────────────────────────────────────
 echo "::group::Generate diff"
 
-# actions/checkout for PRs only fetches the PR ref (refs/pull/N/head).
-# It does NOT create remote tracking branches like origin/main.
-# We must explicitly fetch the base branch.
+# Find the base branch.
+# Strategy: check if remote tracking refs already exist (from a pre-step),
+# then try Gitea/GitHub event context, then try fetching (may fail without auth).
 
-# Unshallow if needed (fetch-depth: 0 already does this, but be safe)
-git fetch --unshallow origin 2>/dev/null || true
+BASE=""
 
-# Fetch base branch with explicit refspec to ensure origin/main exists
-if git fetch origin refs/heads/main:refs/remotes/origin/main 2>/dev/null; then
-  BASE="origin/main"
-elif git fetch origin refs/heads/master:refs/remotes/origin/master 2>/dev/null; then
-  BASE="origin/master"
-else
-  # Fallback: try Gitea/GitHub event context for the target branch
-  TARGET_BRANCH="${GITEA_BASE_REF:-${GITHUB_BASE_REF:-}}"
-  if [ -n "${TARGET_BRANCH}" ] && git fetch origin "refs/heads/${TARGET_BRANCH}:refs/remotes/origin/${TARGET_BRANCH}" 2>/dev/null; then
-    BASE="origin/${TARGET_BRANCH}"
-  else
-    echo "::warning::Could not fetch base branch. Trying origin/HEAD."
-    git fetch origin 2>/dev/null || true
-    BASE="origin/HEAD"
+# 1. Check if remote tracking refs already exist (e.g., workflow pre-fetch step)
+for candidate in origin/main origin/master; do
+  if git rev-parse --verify "$candidate" >/dev/null 2>&1; then
+    BASE="$candidate"
+    echo "Found existing ref: ${BASE}"
+    break
   fi
+done
+
+# 2. Try Gitea/GitHub event context for target branch
+if [ -z "$BASE" ]; then
+  TARGET_BRANCH="${GITEA_BASE_REF:-${GITHUB_BASE_REF:-}}"
+  if [ -n "${TARGET_BRANCH}" ] && git rev-parse --verify "origin/${TARGET_BRANCH}" >/dev/null 2>&1; then
+    BASE="origin/${TARGET_BRANCH}"
+    echo "Found target branch from event: ${BASE}"
+  fi
+fi
+
+# 3. Last resort: try to fetch (will likely fail inside Docker without auth)
+if [ -z "$BASE" ]; then
+  echo "::warning::No base ref found locally. Attempting fetch (may fail without auth)..."
+  git fetch --unshallow origin 2>/dev/null || true
+  for branch in main master; do
+    if git fetch origin "refs/heads/${branch}:refs/remotes/origin/${branch}" 2>/dev/null; then
+      BASE="origin/${branch}"
+      break
+    fi
+  done
+fi
+
+if [ -z "$BASE" ]; then
+  echo "::error::Could not determine base branch. Add a 'Fetch base branch' step before this action: git fetch origin refs/heads/main:refs/remotes/origin/main"
+  exit 1
 fi
 
 echo "Base ref: ${BASE} -> $(git rev-parse --short "${BASE}" 2>/dev/null || echo 'NOT FOUND')"