fix(codeql): bind merge analysis to merge commit SHA

[seonghobae]

Outcome

Make CodeQL merge-preview analysis reliable for stacked and non-default-base PRs. GitHub's merge_commit_sha existed for the merged #1178 run, but refs/pull/1178/merge was absent; both CodeQL merge jobs failed during checkout before analysis.

Change

• bind merge-preview checkout to github.event.pull_request.merge_commit_sha;
• bind CodeQL analyze ref to the same exact merge SHA;
• retain the existing merge-result gate and sha binding;
• update the workflow contract test;
• restore the repository's 100% interrogate gate by documenting the existing fixture initializer.

Related: #1178

Exact verification

• base: 3a6c170
• head: d51638c
• focused CodeQL contract: 3 passed
• full suite: 1297 passed
• statement/branch coverage: 100%
• interrogate: 100%
• actionlint, compileall, and git diff --check: passed

No direct protected-branch mutation, fake status, approval bypass, or force push was used.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 10786e5e-b9fe-4d07-82df-a99a4e27eca6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review and failure RCA

• Exact head: 633342d56801fdb4a9261a165bd31e94cf9a58f4
• Exact base: ac26a07e9fe19760f3b55e3a1db4021ce4776ae6
• Root cause reproduced from merged chore: schedule contextual-orchestrator hourly review repair #1178 run 32491518759: CodeQL merge-preview jobs attempted to fetch refs/pull/1178/merge, which was absent even though the event exposed merge commit efea53a11c90c7ca519af56aed6918124f45826e. Both jobs failed before analysis.
• Repair: checkout and CodeQL analysis now bind to github.event.pull_request.merge_commit_sha, preserving merge-result identity without relying on the synthetic ref.
• Additional hard-gate repair: documented the existing fixture initializer so repository interrogate reaches 100%.

Exact local evidence:

• focused CodeQL contract: 3 passed
• full suite: 1297 passed
• statement/branch coverage: 100%
• interrogate: 100%
• actionlint, compileall, and git diff --check: passed

The PR remains open with 5 queued and 5 skipped hosted check-runs and no formal approval. Decision: WAIT_AND_REMEDIATE until the normal review and hosted gates complete. No bypass, fake status, direct protected push, or force push was used.

[seonghobae]

Exact-head review disposition

• Exact head: 633342d
• Exact base: ac26a07
• Review threads: 0 valid unresolved after direct-SHA verification.
• Devin finding 1: GitHub merge_commit_sha ace87d3 was not advertised by git ls-remote, yet git fetch --no-tags origin SHA succeeded and produced a commit object, confirming the missing-merge-ref checkout path.
• Devin finding 2: current CodeQL merge analysis has upload: false and a local SARIF gate; raw SHA is the exact identity and is not consumed by SARIF upload. The contract test preserves this boundary.
• Exact-head local verification: 1297 tests and 16 subtests passed; statement/branch coverage 100%; compileall, actionlint, and git diff --check passed.
• Current hosted Checks include queued/pending infrastructure runs and no qualifying protected approval.

Decision: WAIT_AND_REMEDIATE. Do not merge until current-head required Checks and protected review requirements complete. No bypass, force push, direct protected-branch write, or fabricated status was used.

[seonghobae]

Maintainer verification — exact head d51638c11c5da1b30dd1867ecd019fd0dd28eb92

• Normal stack restack completed: merged the current root branch fix/pip-audit-pip-2621 at 3a6c170deb15d19521bb10c30aa3839f789eb92f into the CodeQL follow-up. The PR base now points to that exact root head.
• No force push or protected-branch write.
• Focused CodeQL contract: 3 passed; full central suite: 1297 passed, 16 subtests passed; statement/branch coverage 100%; interrogate 100%; compileall, targeted actionlint, CodeGraph sync/status, and git diff --check passed.
• Hosted checks are restarting for the new exact head and are currently queued. The PR remains normal protected-path blocked pending terminal required Checks and independent review.

[seonghobae]

Current-head audit

• Exact head: d51638c11c5da1b30dd1867ecd019fd0dd28eb92
• Exact base: 3a6c170deb15d19521bb10c30aa3839f789eb92f (stacked on current fix(security): repair pip audit and schedule orchestrator review #1198 head)
• Diff is bounded to CodeQL merge-preview SHA binding and its contract test.
• Review threads: 0 unresolved; no qualifying approval is currently recorded.
• Local exact-head verification: 3 focused tests passed; CodeQL workflow actionlint, compileall, and diff check passed.
• Hosted coverage-source-tree is queued; no current source failure is evidenced.
• Decision: WAIT_AND_REMEDIATE; normal protected merge after hosted required checks and approval. No force merge.