[Blackman99]

Follow-up to #1 (review: #1 (comment)), which was merged before this was fixed.

Bug: actions/checkout only fetches the triggering ref, so the runner has no refs/remotes/origin/<pr-branch>. git push --force-with-lease with no tracking ref expects the branch to be absent, so every run after the first was rejected (stale info) and the "Updated PR #N" path was unreachable.

Fix: new scripts/push_pr_branch.sh (called from action.yml) reads the branch tip with git ls-remote and pushes with an explicit lease --force-with-lease=refs/heads/<branch>:<sha> (empty sha = must not exist). Fetch-only (the review suggestion) is not enough with a single-branch refspec: git still can't map the branch to a tracking ref, which the new test caught. The explicit lease works for both, and it still refuses to clobber a branch that moved after the lookup.

Tests: tests/test_action_push.py builds a local bare remote, simulates two scheduled runs (checkout-style and single-branch clones), checks the second push updates the branch, checks the lease still protects a moved branch, and pins the original bug (bare lease → stale info). Skipped on Windows.

Minor review points: create-pr input description + docs table now say to pair it with fail: false; pr_body.py docstring notes it's Action-only (not in the wheel).

CHANGELOG and .github/release-notes/v0.3.0.md updated. No tag or release.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f4af6f8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Blackman99]

Reviewed against GOAL.md: this is in scope. It makes the "apply that change safely" part of create-pr work on every scheduled run, not just the first one.

Checked

• scripts/push_pr_branch.sh: --force-with-lease=refs/heads/<branch>:<sha> from git ls-remote is the right fix. With an empty <sha> git requires the branch to be absent, so the first run behaves exactly as before, and later runs lease on the real remote tip instead of a missing tracking ref. set -euo pipefail plus bash -n are clean.
• Ran the full suite locally on the PR head: 22 passed (tests/test_action_push.py 4/4, covering both checkout-style and --single-branch clones, the moved-branch lease guard, and the original stale info regression).
• Docs, action.yml input description, CHANGELOG and v0.3.0 release notes all agree on "pair with fail: false".

Nit (non-blocking)

• The tests/test_action_push.py module docstring still says the script "fetches it before git push --force-with-lease". It now reads the tip with ls-remote and leases on it explicitly, so that sentence could be updated in a follow-up.

Looks good to merge once CI is green.