build: extend check for edits of autogenerated files to all commits in a pull request

.github/workflows/build.yml

@@ -283,7 +283,7 @@ jobs:
         run: govulncheck ./...
 
       - name: Scan edits of autogenerated files
-        run: bin/check_autogenerated_edits.py
+        run: bin/check_autogenerated_edits.py 'origin/${{ github.base_ref }}'
         if: github.event_name == 'pull_request'
 
   android:

bin/check_autogenerated_edits.py

@@ -4,12 +4,10 @@ This script checks for unauthorized modifications in autogenerated sections of m
 It is designed to be used in a GitHub Actions workflow or a local pre-commit hook.
 
 Features:
-- Detects markdown files changed in the last commit.
+- Detects markdown files changed between two commits (default last commit).
 - Identifies modified autogenerated sections marked by specific comments.
 - Reports violations using GitHub Actions error messages.
 - Exits with a nonzero status code if unauthorized changes are found.
-
-It currently only checks the last commit.
 """
 
 import re
@@ -22,18 +20,18 @@ def run_git(args):
     """
     return subprocess.run(["git"] + args, stdout=subprocess.PIPE, text=True, check=True).stdout.strip()
 
-def get_changed_files():
+def get_changed_files(base, head):
     """
-    Retrieve a list of markdown files that were changed in the last commit.
+    Retrieve a list of markdown files that were changed between the base and head commits.
     """
-    files = run_git(["diff", "--name-only", "HEAD~1", "HEAD"]).splitlines()
+    files = run_git(["diff", "--name-only", base, head]).splitlines()
     return [f for f in files if f.endswith(".md")]
 
-def get_diff(file):
+def get_diff(file, base, head):
     """
-    Get the diff of a given file between the last commit and the current version.
+    Get the diff of a given file between the base and head commits.
     """
-    return run_git(["diff", "-U0", "HEAD~1", "HEAD", "--", file]).splitlines()
+    return run_git(["diff", "-U0", base, head, "--", file]).splitlines()
 
 def get_file_content(ref, file):
     """
@@ -70,7 +68,7 @@ def show_error(file_name, line, message):
     """
     print(f"::error file={file_name},line={line}::{message} at {file_name} line {line}")
 
-def check_file(file):
+def check_file(file, base, head):
     """
     Check a markdown file for modifications in autogenerated regions.
     """
@@ -84,7 +82,7 @@ def check_file(file):
     
     # Entire autogenerated file check.
     if any("autogenerated - DO NOT EDIT" in l for l in new_lines[:10]):
-        if get_diff(file):
+        if get_diff(file, base, head):
             show_error(file, 1, "Autogenerated file modified")
             return True
         return False
@@ -92,7 +90,7 @@ def check_file(file):
     # Partial autogenerated regions.
     regions_new = find_regions(new_lines)
     regions_old = find_regions(old_lines)
-    diff = get_diff(file)
+    diff = get_diff(file, base, head)
     hunk_re = re.compile(r"^@@ -(\d+),?(\d*) \+(\d+),?(\d*) @@")
     new_ln = old_ln = None
     
@@ -124,9 +122,15 @@ def main():
     """
     Main function that iterates over changed files and checks them for violations.
     """
+    base = "HEAD~1"
+    head = "HEAD"
+    if len(sys.argv) > 1:
+        base = sys.argv[1]
+        if len(sys.argv) > 2:
+            head = sys.argv[2]
     found = False
-    for f in get_changed_files():
+    for f in get_changed_files(base, head):
-        if check_file(f):
+        if check_file(f, base, head):
             found = True
     if found:
         sys.exit(1)