[TR1LON]

Problem

Mayhem runs have a parent_revision field, and run creation accepts it (RunPost.parent_revision on POST /api/v2/owner/{owner}/project/{project}/target/{target}/run). mcode-action never sends it, so runs started from GitHub Actions have it empty. It can't be filled in afterwards: PUT …/run/{n} (PutRun) only takes api_run, created_at and updated_at.

With the parent recorded, a run can be tied to the commit it builds on without looking the revision up on the Git host, which fails once that commit is no longer reachable there.

Change

• src/revision.ts:
  • firstParent() reads the first parent header from git cat-file commit <revision>.
    • This works in a depth-1 checkout (actions/checkout's default), where git rev-parse <revision>^ fails: the parent object wasn't fetched, but the commit still names it.
    • Only the headers are read, so a parent … line in a commit message never matches.
    • It never throws.
  • resolveParentRevision() picks, in order: an explicit parent-revision input, then that first parent, then none.
• src/main.ts: passes --parent-revision <sha> to mayhem run when there is one, and logs where it came from (Parent revision: <sha> (from commit object).). When there's no parent it passes nothing, so the run is created exactly as before. That covers a pull request head that isn't in the checkout, and a root commit.
• action.yml and README.md: document the new optional parent-revision input.
• dist/: rebuilt with ncc from the locked dependencies (yarn install --frozen-lockfile).

--parent-revision (alias --scm-parent-revision) is listed in mayhem run --help for CLI 2.14.14, the version the action downloads today.

Testing

• yarn run all (build, format, lint, package, jest): clean, 23/23.
• New tests in __tests__/revision.test.ts:
  • precedence of the input over the commit object;
  • a full-history repo;
  • a depth-1 clone, where HEAD^ fails but the parent is still read;
  • a merge commit, which gives the first parent;
  • a root commit whose message contains a parent line;
  • a commit that isn't present, a non-git directory and a missing directory.
• This PR's own CI run (39271129274) started real Mayhem runs with the new code. Each job logs Parent revision: 8dbc665… (from commit object), which is the parent of the PR head 66ad837, and passes --parent-revision 8dbc665… to mayhem run. The debug job shows the run POST returning 200. Runs created: forallsecure/mcode-action/lighttpd 212–214, forallsecure/mcode-action/mayhemit 69 and mcode-action/mcode-action/lighttpd 72.

Rollout

Workflows on ForAllSecure/mcode-action@v1 pick this up on their next run once it ships in v1.0.x and the v1 tag moves. Workflows that pin a commit need a bump. Runs created before the release keep an empty parent_revision.

🤖 Generated with Claude Code

[github-actions]

Mayhem Automated Code Testing Report

❗ 1 Defects Found

CWE Severity	Defect	Description
7.1	Improper Input Validation	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

---

Testing details found at https://app.mayhem.security/forallsecure/mcode-action/mayhemit/71

[ivg]

you can pass encoding: "utf8" and drop toString, faster and more readable.

[sauliusbc]

PR description is way too verbose for my taste, but lgtm otherwise.