[plan] Fix push_signed_commits.cjs to read file content from commit objects, not working tree

[github-actions]

Objective

Fix push_signed_commits.cjs to read file content from the specific commit object rather than the working tree.

Context

Reported in issue #26156. Currently the code reads file content using fs.readFileSync(path.join(cwd, filePath)) (lines 128, 132), which always reads from the working tree. This is incorrect when replaying older commits in a series, as the working tree reflects the latest commit, not the commit being replayed.

Bug Details

// WRONG: always reads from working tree, not from the commit being processed
const content = fs.readFileSync(path.join(cwd, parts[2]));

If commits A → B → C are being pushed, when processing commit A, the code reads files from the working tree (which is at C), so commits A and B will contain the wrong file contents.

Fix

Replace all fs.readFileSync calls with git show <sha>:<path> to read the blob content at the specific commit:

const { stdout: blobContent } = await exec.getExecOutput(
  "git", ["show", `${sha}:${filePath}`], { cwd, binary: true }
);
additions.push({ path: filePath, contents: Buffer.from(blobContent, "binary").toString("base64") });

Files to Modify

• actions/setup/js/push_signed_commits.cjs

Acceptance Criteria

• File content for additions/modifications is read from the specific commit SHA using git show <sha>:<path>
• Working tree is not read for any file content
• Binary files are correctly base64-encoded from git object content
• Multi-commit pushes produce correct content for each intermediate commit
  Related to bug: multiple critical issues in push_signed_commits #26156

Generated by Plan Command for issue #26156 · ● 383.5K · ◷

• expires on Apr 16, 2026, 4:34 PM UTC