Harden changed-file lint workflow

.forgejo/workflows/build.yml

@@ -11,6 +11,9 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          # The changed-file lint step compares the pushed commit with its parent.
+          fetch-depth: 2
 
       - name: Log into Local Registry
         run: |
@@ -33,8 +36,13 @@ jobs:
 
       - name: Lint changed source files
         run: |
-          FILES=$(git diff --name-only HEAD^ HEAD -- '*.ts' '*.tsx' '*.js' '*.mjs')
+          if BASE=$(git rev-parse HEAD^ 2>/dev/null); then
-          if [ -n "$FILES" ]; then npx eslint $FILES; fi
+            git diff --name-only -z "$BASE" HEAD -- '*.ts' '*.tsx' '*.js' '*.mjs' |
+              xargs -0 -r npx eslint
+          else
+            git ls-files -z -- '*.ts' '*.tsx' '*.js' '*.mjs' |
+              xargs -0 -r npx eslint
+          fi
 
       - name: Build and smoke production image
         run: |