fix(scripts): scope the flaky-test ratchet to check:changed's resolved base (#33782)

check:changed --base=<ref> resolved a merge base for the gates it drives
directly, but the flaky-test ratchet subprocess re-derived its scope from
origin/main. On a checkout whose origin is a stale fork that pulled in
unrelated files and could fail the run. check:changed now forwards its
merge base via ORCA_CODE_QUALITY_BASE (the env the other changed-code
gates already honor), and the ratchet uses it before falling back to
origin/main.

Fixes #33763

Co-authored-by: Neil <neil@stably.ai>

config/scripts/check-changed.mjs

@@ -293,6 +293,8 @@ export async function main(root, argv) {
   const env = {
     ...process.env,
     ORCA_BACKGROUND_LAUNCH: '1',
+    // Why: spawned gates that read the base themselves (flaky-test ratchet) must use --base too.
+    ORCA_CODE_QUALITY_BASE: mergeBase,
     ...(process.stdout.isTTY ? { FORCE_COLOR: '1' } : {})
   }
   if (

config/scripts/check-flaky-test-pattern-ratchet.mjs

@@ -54,7 +54,8 @@ export function listChangedFiles(root = process.cwd()) {
   }
   let base
   try {
-    const mergeBase = git(root, ['merge-base', 'HEAD', 'origin/main']).trim()
+    const requested = process.env.ORCA_CODE_QUALITY_BASE || 'origin/main'
+    const mergeBase = git(root, ['merge-base', 'HEAD', requested]).trim()
     base = resolvePullRequestDiffBase(root, mergeBase)
   } catch {
     try {

config/scripts/check-flaky-test-pattern-ratchet.test.mjs

@@ -1,6 +1,14 @@
-import { describe, expect, it } from 'vitest'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
-import { changedFileScope, countFindings } from './check-flaky-test-pattern-ratchet.mjs'
+import {
+  changedFileScope,
+  countFindings,
+  listChangedFiles
+} from './check-flaky-test-pattern-ratchet.mjs'
 
 describe('countFindings', () => {
   it('counts each rule per file, folding TSX twins and Windows separators', () => {
@@ -32,3 +40,39 @@ describe('changedFileScope', () => {
     expect(changedFileScope(null)).toBeUndefined()
   })
 })
+
+describe('listChangedFiles', () => {
+  let fixture
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    rmSync(fixture, { recursive: true, force: true })
+  })
+
+  it('scopes to the base check:changed forwards instead of a stale origin/main', () => {
+    fixture = mkdtempSync(join(tmpdir(), 'flaky-ratchet-base-'))
+    const git = (...args) =>
+      execFileSync('git', ['-c', 'user.name=t', '-c', 'user.email=t@example.com', ...args], {
+        cwd: fixture,
+        encoding: 'utf8'
+      }).trim()
+    const commit = (file) => {
+      writeFileSync(join(fixture, file), file)
+      git('add', file)
+      git('-c', 'commit.gpgsign=false', 'commit', '-qm', file)
+      return git('rev-parse', 'HEAD')
+    }
+    git('init', '-q')
+    git('update-ref', 'refs/remotes/origin/main', commit('fork-base.txt'))
+    const upstream = commit('upstream-drift.txt')
+    commit('contribution.txt')
+    vi.stubEnv('ORCA_FLAKY_TEST_RATCHET_ALL', '')
+    vi.stubEnv('ORCA_CODE_QUALITY_BASE', '')
+
+    expect([...listChangedFiles(fixture)].sort()).toEqual([
+      'contribution.txt',
+      'upstream-drift.txt'
+    ])
+    vi.stubEnv('ORCA_CODE_QUALITY_BASE', upstream)
+    expect([...listChangedFiles(fixture)]).toEqual(['contribution.txt'])
+  })
+})