fix(ci): scope spell-check diff to PR merge-base

[Dane Parin (SemTiOne)]

Description

Spell-check diffs against live origin/main, not the PR's merge-base. Once main advances, base drift shows up as added lines on unrelated PRs (#3114, #3161, #3188, #3197); e.g. the dorny word from main's dorny/paths-filter bump (commit 8496038e), not from those PRs.

Changes:

• changed_lines.py: git diff --merge-base (only the branch's own changes are reported).
• spell-check.yml: fetch base without --depth=1; shallow base breaks --merge-base (fatal: no merge base found) when main moves between checkout and fetch.
• Regression tests for both.

6/6 tests pass; #3188 repro now yields 0 dorny hits; ruff clean.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

• agent-os-kernel
• agent-mesh
• agent-runtime
• agent-sre
• agent-governance
• docs / root

Checklist

• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any): N/A

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

If AI tools materially shaped this change, briefly note what was used:
Claude for root-cause analysis, the fix, and tests. All output reviewed and verified locally.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

Related Issues

Closes #3514

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[Copilot]

Pull request overview

Fixes the spell-check CI job so it diffs added lines against the PR branch’s merge-base with origin/main, preventing “base drift” in main from being scanned as if it were introduced by the PR.

Changes:

• Update scripts/ci/changed_lines.py to use git diff --merge-base when computing changed files / added lines.
• Simplify spell-check.yml base fetching (with actions/checkout already using fetch-depth: 0) and keep passing origin/${{ github.base_ref }} as the base ref.
• Add regression tests covering merge-base diffing and a base-drift reproduction.

TL;DR: 2 blockers, 0 warnings. Fix #1 and #2 and this ships.

#	Sev	Issue	Where
1	Block	Unrelated dependency/lockfile bumps included in a CI-only bugfix PR (scope drift)	multiple package.json / package-lock.json
2	Block	brace-expansion@5.0.8 in mcp-server lockfile declares Node `20

#1: Remove/split the dependency updates into a separate PR (or explicitly justify them in the PR description).
#2: Align Node support by either raising the package’s Node engine floor or pinning the dependency tree to a Node-18-compatible brace-expansion.

Reviewed changes

Copilot reviewed 5 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/ci/test_changed_lines.py	Adds regression tests asserting merge-base diffing and excluding base drift from added-lines output.
scripts/ci/changed_lines.py	Switches diffing to git diff --merge-base and documents why.
/.github/workflows/spell-check.yml	Fetches base branch normally (checkout already uses full history) and computes added-lines against origin/<base_ref>.
agent-governance-typescript/package.json	Bumps js-yaml (unrelated to stated PR purpose).
agent-governance-typescript/package-lock.json	Updates lockfile for the js-yaml bump.
agent-governance-typescript/agent-os-vscode/package.json	Bumps postcss (unrelated to stated PR purpose).
agent-governance-python/agentmesh-integrations/mastra-agentmesh/package-lock.json	Lockfile-only dependency upgrades (unrelated to stated PR purpose).
agent-governance-python/agent-os/extensions/mcp-server/package-lock.json	Lockfile updates include a transitive Node engine constraint that may drop Node 18 compatibility.
agent-governance-python/agent-mesh/packages/mcp-proxy/package-lock.json	Lockfile-only dependency upgrades (unrelated to stated PR purpose).

Files not reviewed (4)

• agent-governance-python/agent-mesh/packages/mcp-proxy/package-lock.json: Generated file
• agent-governance-python/agent-os/extensions/mcp-server/package-lock.json: Generated file
• agent-governance-python/agentmesh-integrations/mastra-agentmesh/package-lock.json: Generated file
• agent-governance-typescript/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Imran Siddique (imran-siddique)]

Flagging an overlap: #3530 fixes the same Spell-check changed files scoping problem (root cause filed as #3514), which is currently red on 14 open PRs. Both approaches are reasonable, but they should not both land. Worth a maintainer choosing between merge-base scoping here and the branch scoping in #3530.

[liamcrumm]

#3530 landed a merge-base fix in scripts/ci/changed_lines.py, so this bug is now fixed on main and this branch is superseded. The git diff --merge-base form here is the cleaner mechanism, and folding that flag into the merged version would be a reasonable follow-up. Two issues would have needed fixing first either way: spell-check fails on the new test fixtures, which introduce gpgsign and fancytoken without adding them to .cspell-repo-terms.txt, and in a shallow clone git diff --merge-base exits 128 while run_git_diff uses check=True, so it raises an uncaught CalledProcessError.

[liamcrumm]

#3530 landed the merge-base fix in scripts/ci/changed_lines.py, so this is now fixed on main. Closing as superseded. The git diff --merge-base form here is the cleaner mechanism and would be a reasonable follow-up against the merged version. Thanks for catching this one.