From 2174c374c38d321d5db8aecf55287f56ac680b3c Mon Sep 17 00:00:00 2001
From: Victor Moene <victor.moene@northern.tech>
Date: Fri, 9 Oct 2026 17:51:35 +0200
Subject: [PATCH] Checkout upstream instead of local branch when generating
 dependency tables

Ticket: ENT-14725
Signed-off-by: Victor Moene <victor.moene@northern.tech>
---
 src/cfengine_cli/deptool.py | 47 +++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)

diff --git a/src/cfengine_cli/deptool.py b/src/cfengine_cli/deptool.py
index 502decf6..8e83db67 100644
--- a/src/cfengine_cli/deptool.py
+++ b/src/cfengine_cli/deptool.py
@@ -109,6 +109,8 @@ def __init__(
                           a ref from previous work might be left checked out.
         """
         self.repo_path = repo_path
+        self.repo_owner = repo_owner
+        self.repo_name = repo_name
 
         repo_url = "https://github.com/{}/{}.git".format(repo_owner, repo_name)
 
@@ -211,6 +213,36 @@ def is_git_branch(self, ref):
             return False
         return True
 
+    def upstream_remote(self):
+        result = self.run_command("remote", "-v", capture_output=True)
+        upstream = "github\\.com[:/]{}/{}(\\.git)?/?$".format(
+            re.escape(self.repo_owner), re.escape(self.repo_name)
+        )
+        for line in result.stdout.splitlines():
+            parts = line.split()
+            # GitHub owner and repository names are case-insensitive
+            if len(parts) >= 2 and re.search(upstream, parts[1], re.IGNORECASE):
+                return parts[0]
+        return None
+
+    def upstream_branch(self, ref):
+        remote = self.upstream_remote()
+        if remote is None:
+            log.warning(
+                "No remote points to github.com/{}/{}, using local refs".format(
+                    self.repo_owner, self.repo_name
+                )
+            )
+            return None
+        remote_ref = "{}/{}".format(remote, ref)
+        try:
+            self.run_command(
+                "show-ref", "--verify", "refs/remotes/{}".format(remote_ref)
+            )
+        except subprocess.CalledProcessError:
+            return None
+        return remote_ref
+
 
 def pretty(data):
     return json.dumps(data, indent=2)
@@ -311,10 +343,17 @@ def deps_versions(self, ref):
         ```
         The ref is checked out during the execution of this function.
         """
-        self.buildscripts_repo.checkout(ref)
-        # also support checking out refs that are not necessarily branches, such as tags
-        if self.buildscripts_repo.is_git_branch(ref):
-            self.buildscripts_repo.run_command("pull")
+        upstream_ref = self.buildscripts_repo.upstream_branch(ref)
+        if upstream_ref is not None:
+            self.buildscripts_repo.checkout(upstream_ref)
+        else:
+            if self.buildscripts_repo.is_git_branch(ref):
+                log.warning(
+                    "Branch '{}' not found in upstream remote, using local branch".format(
+                        ref
+                    )
+                )
+            self.buildscripts_repo.checkout(ref)
 
         deps_versions = {}
         deps_list = self.deps_list(ref)