From bdd8a543babe4e876feb9223a754e14dcd06f611 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 22 Aug 2026 02:01:46 +0900
Subject: [PATCH] fix(codeql): bind merge analysis to merge commit SHA

---
 .github/workflows/codeql-pr.yml               | 6 ++++--
 organization_commercial_readiness_fixtures.py | 1 +
 tests/test_codeql_pr_workflow_contract.py     | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index 240e7139d..b5c57a829 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -194,7 +194,9 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-          ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
+          # GitHub can omit the synthetic merge ref for stacked/non-default-base PRs;
+          # the event's merge SHA is the exact merge-result identity we must analyze.
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
@@ -208,7 +210,7 @@ jobs:
           category: "/language:${{ matrix.language }}-merge"
           upload: false
           output: codeql-results-merge
-          ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
           sha: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Enforce CodeQL Medium+ SARIF gate
diff --git a/organization_commercial_readiness_fixtures.py b/organization_commercial_readiness_fixtures.py
index d86596196..3b903eb97 100644
--- a/organization_commercial_readiness_fixtures.py
+++ b/organization_commercial_readiness_fixtures.py
@@ -90,6 +90,7 @@ def __init__(
         repositories: list[dict[str, Any]],
         snapshots: dict[str, list[RepositorySnapshot | Exception]],
     ) -> None:
+        """Configure deterministic repository snapshots and dispatch records."""
         self.repositories = repositories
         self.snapshots = snapshots
         self.dispatched_repairs: list[tuple[str, str]] = []
diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py
index 813385b23..7a23c99da 100644
--- a/tests/test_codeql_pr_workflow_contract.py
+++ b/tests/test_codeql_pr_workflow_contract.py
@@ -36,7 +36,8 @@ def test_codeql_pr_workflow_gates_head_and_merge_sarif_locally() -> None:
     assert "github.event.pull_request.head.sha" in workflow
     assert "github.event.pull_request.merge_commit_sha" in workflow
     assert "refs/pull/{0}/head" in workflow
-    assert "refs/pull/{0}/merge" in workflow
+    assert workflow.count("ref: ${{ github.event.pull_request.merge_commit_sha }}") == 2
+    assert "refs/pull/{0}/merge" not in workflow
     assert workflow.count("security-events: read") == 2
     assert "security-events: write" not in workflow