Detect non-main default branches in single-branch CI checkouts

actions/checkout fetches one branch and leaves no origin/HEAD. Since 2.6.6
dropped the git fetch --all that recreated origin/HEAD, default-branch
detection fell back to main/master, so scans on repos whose default branch
is dev never became the branch head.

When origin/HEAD is missing, read the default branch from the GitHub event
payload, then from git ls-remote --symref origin HEAD, before the
main/master fallback.

Author: mtorp

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.10.6
+
+### Fixed: default-branch detection in single-branch CI checkouts
+
+- Repositories whose default branch isn't `main` or `master` are detected as the
+  default branch again when the checkout has no `origin/HEAD`, as with
+  `actions/checkout`. The CLI reads the default branch from the GitHub event
+  payload or asks the remote, before falling back to `main`/`master`. Scans on
+  those branches become the branch head again.
+
 ## 2.10.5
 
 ### Changed: bump pinned @coana-tech/cli to 15.11.4

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.10.5"
+version = "2.10.6"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.10.5'
+__version__ = '2.10.6'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/git_interface.py

@@ -1,3 +1,4 @@
+import json
 import os
 import re
 import time
@@ -638,27 +639,72 @@ def get_default_branch_name(self) -> str:
         Returns:
             Default branch name (e.g., 'main', 'master')
         """
+        cached = getattr(self, "_default_branch_name", None)
+        if cached:
+            return cached
+        self._default_branch_name = self._detect_default_branch_name()
+        return self._default_branch_name
+
+    def _detect_default_branch_name(self) -> str:
         try:
-            # Try to get the default branch from remote HEAD
-            remote_head = self.repo.remotes.origin.refs.HEAD
-            # Extract branch name from refs/remotes/origin/HEAD -> refs/remotes/origin/main
-            default_branch = str(remote_head.reference).split('/')[-1]
-            log.debug(f"Default branch detected: {default_branch}")
+            default_branch = self.repo.remotes.origin.refs.HEAD.reference.remote_head
+            log.debug(f"Default branch detected from origin/HEAD: {default_branch}")
             return default_branch
         except Exception as error:
-            log.debug(f"Could not determine default branch from remote: {error}")
-            # Fallback: check common default branch names
-            for branch_name in ['main', 'master']:
-                try:
-                    if f'origin/{branch_name}' in [str(ref) for ref in self.repo.remotes.origin.refs]:
-                        log.debug(f"Using fallback default branch: {branch_name}")
-                        return branch_name
-                except Exception:
-                    continue
-            
-            # Last fallback: assume 'main'
-            log.debug("Using final fallback default branch: main")
-            return 'main'
+            log.debug(f"Could not determine default branch from origin/HEAD: {error}")
+
+        # CI checkouts such as actions/checkout fetch a single branch and leave no origin/HEAD.
+        default_branch = (
+            self._default_branch_from_github_event()
+            or self._default_branch_from_remote()
+        )
+        if default_branch:
+            return default_branch
+
+        for branch_name in ['main', 'master']:
+            try:
+                if f'origin/{branch_name}' in [str(ref) for ref in self.repo.remotes.origin.refs]:
+                    log.debug(f"Using fallback default branch: {branch_name}")
+                    return branch_name
+            except Exception:
+                continue
+
+        log.debug("Using final fallback default branch: main")
+        return 'main'
+
+    @staticmethod
+    def _default_branch_from_github_event() -> str | None:
+        event_path = os.getenv('GITHUB_EVENT_PATH')
+        if not event_path:
+            return None
+        try:
+            with open(event_path, encoding="utf-8") as event_file:
+                default_branch = json.load(event_file).get("repository", {}).get("default_branch")
+        except Exception as error:
+            log.debug(f"Could not read default branch from GitHub event payload: {error}")
+            return None
+        if default_branch:
+            log.debug(f"Default branch detected from GitHub event payload: {default_branch}")
+        return default_branch or None
+
+    def _default_branch_from_remote(self) -> str | None:
+        try:
+            output = self.repo.git.ls_remote(
+                "--symref",
+                "origin",
+                "HEAD",
+                env={"GIT_TERMINAL_PROMPT": "0"},
+                kill_after_timeout=30,
+            )
+        except Exception as error:
+            log.debug(f"Could not query origin for its default branch: {error}")
+            return None
+        for line in output.splitlines():
+            match = re.match(r"ref: refs/heads/(\S+)\tHEAD$", line)
+            if match:
+                log.debug(f"Default branch detected from origin: {match.group(1)}")
+                return match.group(1)
+        return None
 
     def is_commit_on_default_branch(self) -> bool:
         """

tests/unit/test_git_interface.py

@@ -17,6 +17,7 @@
     "GITHUB_BASE_REF",
     "GITHUB_EVENT_BEFORE",
     "GITHUB_EVENT_NAME",
+    "GITHUB_EVENT_PATH",
     "GITHUB_HEAD_REF",
     "GITHUB_REF",
     "GITHUB_SHA",
@@ -375,3 +376,77 @@ def test_unresolvable_base_commit_warns_and_falls_back(
         for record in caplog.records
     )
     fetch.assert_called_once()
+
+
+@pytest.fixture
+def single_branch_checkout(tmp_path):
+    """A repo whose default branch is dev, checked out the way actions/checkout does."""
+    source = tmp_path / "source"
+    source.mkdir()
+    _git(source, "init", "-b", "dev")
+    _git(source, "config", "user.name", "Socket Test")
+    _git(source, "config", "user.email", "socket@example.com")
+    (source / "package.json").write_text("{}\n", encoding="utf-8")
+    _git(source, "add", "package.json")
+    _git(source, "commit", "-m", "base")
+    origin = tmp_path / "origin.git"
+    _git(tmp_path, "clone", "--bare", str(source), str(origin))
+
+    checkout = tmp_path / "checkout"
+    checkout.mkdir()
+    _git(checkout, "init")
+    _git(checkout, "remote", "add", "origin", str(origin))
+    _git(checkout, "fetch", "--no-tags", "--depth=1", "origin", "+refs/heads/dev:refs/remotes/origin/dev")
+    _git(checkout, "checkout", "-B", "dev", "refs/remotes/origin/dev")
+    return checkout
+
+
+def test_single_branch_checkout_detects_non_main_default_branch(
+        single_branch_checkout, monkeypatch, mocker
+):
+    monkeypatch.setenv("GITHUB_REF", "refs/heads/dev")
+    mocker.patch.object(Git, "ensure_safe_directory")
+
+    repository = Git(str(single_branch_checkout))
+
+    assert repository.get_default_branch_name() == "dev"
+    assert repository.is_default_branch is True
+
+
+def test_github_event_payload_supplies_default_branch(
+        single_branch_checkout, tmp_path, monkeypatch, mocker
+):
+    event_path = tmp_path / "event.json"
+    event_path.write_text('{"repository": {"default_branch": "dev"}}', encoding="utf-8")
+    monkeypatch.setenv("GITHUB_REF", "refs/heads/dev")
+    monkeypatch.setenv("GITHUB_EVENT_PATH", str(event_path))
+    mocker.patch.object(Git, "ensure_safe_directory")
+    remote_lookup = mocker.patch.object(Git, "_default_branch_from_remote")
+
+    repository = Git(str(single_branch_checkout))
+
+    assert repository.is_default_branch is True
+    remote_lookup.assert_not_called()
+
+
+def test_origin_head_wins_without_remote_lookup(single_branch_checkout, monkeypatch, mocker):
+    _git(single_branch_checkout, "symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/dev")
+    monkeypatch.setenv("GITHUB_REF", "refs/heads/dev")
+    mocker.patch.object(Git, "ensure_safe_directory")
+    remote_lookup = mocker.patch.object(Git, "_default_branch_from_remote")
+
+    repository = Git(str(single_branch_checkout))
+
+    assert repository.is_default_branch is True
+    remote_lookup.assert_not_called()
+
+
+def test_feature_branch_in_single_branch_checkout_is_not_default(
+        single_branch_checkout, monkeypatch, mocker
+):
+    monkeypatch.setenv("GITHUB_REF", "refs/heads/feature")
+    mocker.patch.object(Git, "ensure_safe_directory")
+
+    repository = Git(str(single_branch_checkout))
+
+    assert repository.is_default_branch is False