From 91e98c58ba1e8977dc8aa03f575921ca894dc93f Mon Sep 17 00:00:00 2001
From: Martin Milata <martin@martinmilata.cz>
Date: Fri, 1 Dec 2023 00:05:32 +0100
Subject: [PATCH] ci: fix changelog check for github

---
 .github/workflows/prebuild.yml | 3 ++-
 ci/check_changelog.sh          | 6 ++++++
 ci/shell.nix                   | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index dd92266ce..61b827c2b 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -59,7 +59,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: "recursive"
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: "Run changelog check"
         run: ./ci/check_changelog.sh
 
diff --git a/ci/check_changelog.sh b/ci/check_changelog.sh
index c9cab8489..03618fb73 100755
--- a/ci/check_changelog.sh
+++ b/ci/check_changelog.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -u
+
 base_branch=main
 fail=0
 subdirs="core core/embed/boardloader core/embed/bootloader core/embed/bootloader_ci legacy/bootloader legacy/firmware legacy/intermediate_fw python"
@@ -51,8 +53,12 @@ check_release_branch () {
     fi
 }
 
+# gitlab
 if echo "$CI_COMMIT_BRANCH" | grep -Eq "^(release|secfix)/"; then
     check_release_branch
+# github, TODO this only makes sense running on branches but not pull requests
+elif $(git branch --show-current) | grep -Eq "^(release|secfix)/"; then
+    check_release_branch
 else
     check_feature_branch
 fi
diff --git a/ci/shell.nix b/ci/shell.nix
index f47030fc6..5e438b381 100644
--- a/ci/shell.nix
+++ b/ci/shell.nix
@@ -139,6 +139,7 @@ stdenvNoCC.mkDerivation ({
     ffmpeg
     dejavu_fonts
   ] ++ lib.optionals devTools [
+    shellcheck
     gdb
     openocd-stm
   ] ++ lib.optionals (devTools && acceptJlink) [