[aw]: Follow-up to #1318 / #1325: no way to force a full-depth self checkout — create-pull-request can't compute a diff base on shallow-default agent pools #1413

Submission requirements

• I generated this issue with an agent that used .github/agents/ado-aw.agent.md.
• I reviewed the generated issue and confirm it is being filed directly in githubnext/ado-aw.

Problem summary

On an agent pool whose default git fetch is shallow (fetchDepth: 1, triggering ref only —
a common default for self-hosted and many hosted pools), a compiled ado-aw pipeline that uses
safe-outputs.create-pull-request cannot open the PR: the executor can't determine a diff
base. There is currently no front-matter way to give the auto-generated checkout: self step
full history, so the only fix is to hand-edit the generated .lock.yml — which then trips
ado-aw's own integrity check.

create-pull-request needs full history (and origin/<target-branch>) to compute a merge-base
for the patch. But ado-aw emits a bare checkout: self (no fetchDepth), which on a
shallow-default pool fetches only a shallow slice of the triggering ref — no merge-base, no
target ref. #1318 / PR #1325 ("per-repo checkout tuning for fetch depth/tags") looked like the
fix, but as shipped in 0.42 it does not cover self:

• The self-checkout: block from [agent-issue]: Add fetch-tags (and shallow fetch-depth) tuning to the auto-generated checkout: self step #1318 is not a valid field in 0.42. Using it is a hard
  compile error (it is absent from the schema's valid-field list), so the "full control of the
  self checkout" described there isn't reachable.
• repos: does not tune the self checkout. repos: [{ name: self, fetch-depth: 0 }]
  (and the fetchDepth: 0 spelling) compiles but emits no fetchDepth on checkout: self.
• Even [agent-issue]: Add fetch-tags (and shallow fetch-depth) tuning to the auto-generated checkout: self step #1318's design wouldn't force full history here. Per its notes, fetch-depth: 0
  means "omit the fetchDepth line and rely on ADO's default." When that default is shallow,
  omitting the field yields exactly the broken shallow clone. There is no way to emit an
  explicit fetchDepth: 0 (force a full clone) for self.

Because there's no supported knob, the only workaround is a post-compile edit of the generated
lock — and that edit then fails ado-aw's own in-lock "Verify pipeline integrity" step
(ado-aw check <lock>), which re-compiles the source and rejects any divergence. So a shallow
pool needs two out-of-band lock edits: add fetchDepth: 0, then neuter the integrity check
that rejects it.

Reproduction details

Environment: an agent pool whose default git fetch is shallow;
safe-outputs.create-pull-request configured with a target-branch.

1. Author any workflow that uses create-pull-request and compile with ado-aw 0.42.0. The
   generated lock contains a bare - checkout: self (no fetchDepth).
2. Run it so the agent commits a change and the executor tries to open the PR.

Observed — the executor cannot build the patch:

Cannot determine diff base: no remote tracking branch found. This can happen with shallow
clones (fetchDepth: 1). Ensure the pipeline fetches full history or push a tracking branch.

Front-matter attempts that do NOT fix it:

• self-checkout: { fetch-depth: 0 } → compile error (unknown field).
• repos: [{ name: self, fetch-depth: 0 }] / { fetchDepth: 0 } → compiles, emits nothing.

The only thing that fixes it is editing the generated lock post-compile to add
fetchDepth: 0 to every checkout: self (forcing a full clone, which fetches all heads
incl. origin/<target-branch>) — and additionally making the "Verify pipeline integrity"
step non-fatal, since it otherwise rejects the added lines.

Proposed next step

Either resolves it; (b) is the more robust and pool-agnostic fix:

(a) Ship self checkout tuning that can force full history — e.g. the top-level
self-checkout: block from #1318, with semantics that emit an explicit fetchDepth: 0
(or a full-history: true) rather than omitting the field. "Omit and trust the default" is
insufficient on shallow-default pools.

(b) Make create-pull-request independent of checkout depth: before computing the
patch, have the executor fetch the target ref itself, e.g.
git fetch --no-tags origin +refs/heads/<target-branch>:refs/remotes/origin/<target-branch>
(and --unshallow when the clone is shallow). This fixes the diff base regardless of pool
defaults or checkout config and matches the executor's own error hint ("ensure the pipeline
fetches full history").

Either fix also removes the need to hand-edit the lock, so the integrity-check conflict
disappears with it.