V48 (impl-only): Fix Sandbox.create git clone for branch+SHA deposits

Prefer branch shallow clone over depth:1 + bare commit SHA so Vercel Sandbox
create no longer fails with bad_request: git clone failed. Evidence still pins
the selected commit via sourceRevision; bare-SHA-only paths omit depth.

Author: geraldarthurdavis

uapi/lib/deposit-source-provisioning.ts

@@ -133,6 +133,106 @@ export interface DepositInBoxHostResult {
   outcome: PipelineHostRunResult["outcome"];
 }
 
+/** Full or abbreviated git object id (7–40 hex). */
+const GIT_COMMIT_SHA_RE = /^[0-9a-f]{7,40}$/i;
+
+export type DepositSandboxGitRevisionStrategy =
+  | "branch-shallow"
+  | "commit-full"
+  | "ref-shallow";
+
+/**
+ * Git source for `Sandbox.create` deposit clones.
+ *
+ * Vercel Sandbox performs a single git clone at create time. A common failure
+ * is `bad_request: git clone failed` when `revision` is a commit SHA with
+ * `depth: 1` — shallow clones fetch advertised refs (branches/tags), not
+ * arbitrary SHAs (GitHub often rejects unadvertised objects).
+ *
+ * Strategy (mirrors LocalHost intent, adapted for create-time-only clone):
+ * 1. **Branch present** → shallow clone that branch tip (`depth: 1`).
+ * 2. **Commit SHA only** → full clone at that revision (omit `depth`).
+ * 3. **Other ref** (tag / symbolic) → shallow clone that ref.
+ *
+ * Evidence still records the exact `commit` via `sourceRevision`; only the
+ * create-time clone ref is adjusted for Vercel reachability.
+ */
+export function buildDepositSandboxGitSource(input: {
+  repositoryFullName: string;
+  /** Preferred product revision (often the selected commit SHA). */
+  revision: string;
+  branch: string | null;
+  commit: string | null;
+  token?: string;
+}): {
+  source: {
+    type: "git";
+    url: string;
+    revision: string;
+    username?: string;
+    password?: string;
+    depth?: number;
+  };
+  strategy: DepositSandboxGitRevisionStrategy;
+  /** Ref actually passed to Sandbox.create (branch, SHA, or other). */
+  cloneRevision: string;
+  depth: number | null;
+} {
+  const branch = input.branch?.trim() || "";
+  const commit = (input.commit || "").trim();
+  const revision = (input.revision || "").trim();
+  const url = `https://github.com/${input.repositoryFullName}.git`;
+  const auth =
+    input.token
+      ? { username: "x-access-token" as const, password: input.token }
+      : {};
+
+  // Prefer a non-SHA branch name even when revision/commit is a full SHA.
+  if (branch && !GIT_COMMIT_SHA_RE.test(branch)) {
+    return {
+      source: {
+        type: "git",
+        url,
+        revision: branch,
+        depth: 1,
+        ...auth,
+      },
+      strategy: "branch-shallow",
+      cloneRevision: branch,
+      depth: 1,
+    };
+  }
+
+  const effective = commit || revision || "HEAD";
+  if (GIT_COMMIT_SHA_RE.test(effective)) {
+    // Omit depth: shallow + bare SHA is the create failure mode we hit in prod.
+    return {
+      source: {
+        type: "git",
+        url,
+        revision: effective,
+        ...auth,
+      },
+      strategy: "commit-full",
+      cloneRevision: effective,
+      depth: null,
+    };
+  }
+
+  return {
+    source: {
+      type: "git",
+      url,
+      revision: effective,
+      depth: 1,
+      ...auth,
+    },
+    strategy: "ref-shallow",
+    cloneRevision: effective,
+    depth: 1,
+  };
+}
+
 /**
  * Run the deposit synthesis IN the sandbox box (#25). Builds an asset-pack host in
  * DEPOSIT mode (git source for the revision + steering), dispatches it on the sandbox
@@ -160,6 +260,13 @@ export async function runDepositInBoxHost(input: {
   shouldAbort?: () => boolean | Promise<boolean>;
   hostFactory?: () => Promise<DepositInBoxHost>;
 }): Promise<DepositInBoxHostResult> {
+  const gitSource = buildDepositSandboxGitSource({
+    repositoryFullName: input.repositoryFullName,
+    revision: input.revision,
+    branch: input.branch,
+    commit: input.commit,
+    token: input.token,
+  });
   const plan = buildAssetPackSandboxHostPlan({
     mode: "asset_pack_pipeline",
     synthesizeMode: "deposit",
@@ -176,14 +283,7 @@ export async function runDepositInBoxHost(input: {
       branch: input.branch || "main",
       commit: input.commit || input.revision,
     },
-    source: {
-      type: "git",
-      url: `https://github.com/${input.repositoryFullName}.git`,
-      revision: input.revision,
-      username: input.token ? "x-access-token" : undefined,
-      password: input.token,
-      depth: 1,
-    },
+    source: gitSource.source,
     depositSteering: {
       obfuscations: input.obfuscations,
       forcedExclusions: input.forcedExclusions,
@@ -212,6 +312,11 @@ export async function runDepositInBoxHost(input: {
     hasGitSource: Boolean(plan.createOptions.source),
     synthesizeMode: plan.manifest.synthesizeMode ?? null,
     repositoryFullName: input.repositoryFullName,
+    gitRevisionStrategy: gitSource.strategy,
+    gitCloneRevision: gitSource.cloneRevision,
+    gitDepth: gitSource.depth,
+    sourceCommit: input.commit || null,
+    sourceBranch: input.branch || null,
   };
   bitcodeServerTelemetry("info", "deposit-sandbox-host", "plan-ready", createSummary);
 

uapi/tests/lib/depositSourceProvisioning.test.ts

@@ -2,6 +2,7 @@
  * @jest-environment node
  */
 import {
+  buildDepositSandboxGitSource,
   createDepositLocalHostCloneForRun,
   provisionDepositCheckout,
   provisionDepositSourceInventory,
@@ -181,6 +182,51 @@ describe('resolveDepositPipelineHost', () => {
   });
 });
 
+describe('buildDepositSandboxGitSource', () => {
+  it('prefers branch shallow clone when branch is present (even if revision is a SHA)', () => {
+    const built = buildDepositSandboxGitSource({
+      repositoryFullName: 'advancedengineeredsoftware/Bitcode',
+      revision: 'f956577ce478e90d629db48c452102e582fa081c',
+      branch: 'version/v48',
+      commit: 'f956577ce478e90d629db48c452102e582fa081c',
+      token: 'ghs_tok',
+    });
+    expect(built.strategy).toBe('branch-shallow');
+    expect(built.source).toMatchObject({
+      type: 'git',
+      url: 'https://github.com/advancedengineeredsoftware/Bitcode.git',
+      revision: 'version/v48',
+      depth: 1,
+      username: 'x-access-token',
+      password: 'ghs_tok',
+    });
+  });
+
+  it('omits depth for bare commit SHAs (avoid shallow unadvertised-object failure)', () => {
+    const built = buildDepositSandboxGitSource({
+      repositoryFullName: 'o/r',
+      revision: 'f956577ce478e90d629db48c452102e582fa081c',
+      branch: null,
+      commit: 'f956577ce478e90d629db48c452102e582fa081c',
+    });
+    expect(built.strategy).toBe('commit-full');
+    expect(built.source.revision).toBe('f956577ce478e90d629db48c452102e582fa081c');
+    expect(built.source.depth).toBeUndefined();
+    expect(built.depth).toBeNull();
+  });
+
+  it('shallow-clones non-SHA refs (tags / symbolic)', () => {
+    const built = buildDepositSandboxGitSource({
+      repositoryFullName: 'o/r',
+      revision: 'v1.2.3',
+      branch: null,
+      commit: null,
+    });
+    expect(built.strategy).toBe('ref-shallow');
+    expect(built.source).toMatchObject({ revision: 'v1.2.3', depth: 1 });
+  });
+});
+
 describe('runDepositInBoxHost (#25)', () => {
   it('dispatches a deposit-mode host and returns evidence.depositOptions', async () => {
     let receivedPlan: any;
@@ -199,9 +245,9 @@ describe('runDepositInBoxHost (#25)', () => {
     };
     const result = await runDepositInBoxHost({
       repositoryFullName: 'engineeredsoftware/demo',
-      revision: 'abc123',
+      revision: 'abc123def456',
       branch: 'main',
-      commit: 'abc123',
+      commit: 'abc123def456',
       token: 'ghs_tok',
       obfuscations: 'hide internal names',
       forcedExclusions: ['secret/'],
@@ -215,7 +261,17 @@ describe('runDepositInBoxHost (#25)', () => {
     // The dispatched plan ran the deposit lens in-box, with a git source + steering.
     expect(receivedPlan.manifest.synthesizeMode).toBe('deposit');
     expect(receivedPlan.manifest.depositSteering).toMatchObject({ forcedExclusions: ['secret/'] });
-    expect(receivedPlan.createOptions.source).toMatchObject({ type: 'git', revision: 'abc123' });
+    // Clone uses the branch (shallow), not the bare SHA — avoids Sandbox create git-clone 400.
+    expect(receivedPlan.createOptions.source).toMatchObject({
+      type: 'git',
+      revision: 'main',
+      depth: 1,
+    });
+    // Evidence still pins the selected commit.
+    expect(receivedPlan.manifest.sourceRevision).toMatchObject({
+      branch: 'main',
+      commit: 'abc123def456',
+    });
     // Vercel Sandbox v2: persistence is default — deposit must opt out.
     expect(receivedPlan.createOptions.persistent).toBe(false);
     expect(typeof receivedPlan.createOptions.name).toBe('string');