fix(workbench): give the workbench a ref so reviewer clones succeed

internal/workbench/workbench.go

@@ -23,8 +23,10 @@ import (
 )
 
 const (
-	metadataSchemaVersion                   = 2
-	checkoutModeArtifactClone               = "artifact-clone"
+	metadataSchemaVersion     = 2
+	checkoutModeArtifactClone = "artifact-clone"
+	// workbenchHeadRef gives the workbench a ref so it is a clonable repository.
+	workbenchHeadRef                        = "refs/heads/cr-review-head"
 	defaultReviewerWorkspaceToolOutputBytes = 32 * 1024
 )
 
@@ -142,6 +144,16 @@ func (p *RunPreparer) Prepare(ctx context.Context, req Request) error {
 	if _, err := p.deps.gitCommand(ctx, req.Artifacts.WorkbenchRepoDir, "checkout", "--detach", req.ReviewPR.Head.SHA); err != nil {
 		return fmt.Errorf("pipeline: checkout workbench head %s: %w", prref.ShortSHA(req.ReviewPR.Head.SHA), err)
 	}
+	// Give the workbench at least one ref.
+	//
+	// Everything above fetches by SHA and checks out detached, so the repo ends
+	// up with FETCH_HEAD and no refs/ at all. Git does not consider such a
+	// directory a repository, so the per-reviewer `git clone` of this workbench
+	// fails with "repository does not exist" -- and a reviewer that cannot start
+	// reports zero findings, which the rollup renders as a clean review.
+	if _, err := p.deps.gitCommand(ctx, req.Artifacts.WorkbenchRepoDir, "update-ref", workbenchHeadRef, req.ReviewPR.Head.SHA); err != nil {
+		return fmt.Errorf("pipeline: record workbench head ref: %w", err)
+	}
 	if err := verifyClean(ctx, p.deps, req.Artifacts.WorkbenchRepoDir, req.ReviewPR.Head.SHA); err != nil {
 		return err
 	}

internal/workbench/workbench_test.go

@@ -724,3 +724,44 @@
 func (s smokeStream) Wait(context.Context) (llm.Response, error) {
 	return llm.Response{StructuredOutput: []byte(s.output)}, nil
 }
+
+// The workbench is cloned once per reviewer. Everything that builds it fetches
+// by SHA and checks out detached, so without an explicit ref the directory has
+// no refs/ at all -- git then refuses to call it a repository and every
+// per-reviewer clone fails. A reviewer that cannot start reports zero findings,
+// which a rollup renders as a clean review, so this failure is silent and
+// actively misleading.
+func TestPrepareLeavesWorkbenchClonable(t *testing.T) {
+	ctx := context.Background()
+	fixture := newWorkbenchGitFixture(t)
+	artifacts := runartifact.FromDir(t.TempDir())
+
+	if err := Prepare(ctx, Deps{
+		GitCommand: testGitRunner(t, map[string]string{
+			"https://github.com/open-cli-collective/codereview-cli.git": fixture.repoDir,
+		}),
+	}, Request{
+		PRRef:        fixture.pr.Ref,
+		ReviewPR:     fixture.pr,
+		ChangedFiles: []string{"main.go"},
+		Artifacts:    artifacts,
+	}); err != nil {
+		t.Fatalf("Prepare: %v", err)
+	}
+
+	// The head must be reachable through a real ref, not only FETCH_HEAD.
+	if got := strings.TrimSpace(gitCommandOutput(t, artifacts.WorkbenchRepoDir, "rev-parse", workbenchHeadRef)); got != fixture.headSHA {
+		t.Fatalf("%s = %q, want head %q", workbenchHeadRef, got, fixture.headSHA)
+	}
+
+	// The property that actually matters: it can be cloned, the way each
+	// reviewer workspace is created.
+	dest := filepath.Join(t.TempDir(), "reviewer")
+	out, err := exec.CommandContext(ctx, "git", "clone", "--no-hardlinks", artifacts.WorkbenchRepoDir, dest).CombinedOutput()
+	if err != nil {
+		t.Fatalf("clone workbench: %v: %s", err, out)
+	}
+	if got := strings.TrimSpace(gitCommandOutput(t, dest, "rev-parse", "HEAD")); got != fixture.headSHA {
+		t.Fatalf("cloned HEAD = %q, want %q", got, fixture.headSHA)
+	}
+}