[serge-ivo]

Part of #98: steps 1–2, no schema change. Step 3 (detectCiContext → meta.git / meta.ci) is stacked on this branch in a follow-up PR.

What changed (1b3b633)

• detect.ts: a detached HEAD or a missing git repo now gives branch: "". It used to give "main". A missing remote no longer discards the real local branch.
• report/components.ts: fileLink takes a ref (sha or branch). An empty ref renders plain text, so there is no more /blob//. New linkRef(meta) prefers meta.git.sha, then the branch, then "".
• report/html.ts: uses linkRef.
• upload.ts: the currentGitSha sent by --upload is the PR head sha on PR events, else GITHUB_SHA, else HEAD. The quality-gate status therefore lands on the PR head, not GitHub's merge commit.
• Fixtures: fixtures/github-events/ holds push, push-new-branch, pull_request, pull_request_target, merge_group and workflow_dispatch.

Verification

• pnpm build: clean. pnpm lint: 0 errors (62 warnings, same as the baseline on main).
• pnpm test: 64 files, 752/752 passing (main baseline 739, plus 13 new).
• New tests:
  • detect.test.ts › "never guesses main on a detached HEAD".
  • pages.test.ts › "report file links" block.
  • upload.test.ts › "uses the PR head sha on pull_request, not the merge sha".
• Every test passes an explicit env or saves and restores GITHUB_*, so the suite is safe under Actions.

Note: with only this PR merged, a detached build outside CI has no sha in its meta, so its file links render as plain text. The stacked step-3 PR adds meta.git.sha, which turns them into permalinks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SmtSK7qDTyXhimJ9grap88

[vibecode-qa]

VibeCode QA

PR #112 (fix/98-ci-head-sha → main)

No workflow found. Add this to enable automatic PR scanning:

name: VibeCode QA
on:
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
  pull-requests: write
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: vibecodeqa/action@v1
        with:
          fail-under: "70"

Setup guide | Dashboard

[serge-ivo]

Adversarial review, round 1: #112 (cli#98 steps 1–2)

Verdict: READY. Every finding below is minor or a nit, and #113 resolves each of them. This holds as long as #113 merges right after this PR.

Verified at 1b3b633: tsc clean, biome check src/ clean, vitest run 752/752 passed (dist/ built first, since cli.test.ts spawns dist/cli.js). Also merged in stack order with #113/#114/#116/#115; see the #113 review for the result.

Findings

1. minor, CONFIRMED. src/report/html.ts:58 / components.ts:19-21: on this PR alone nothing writes meta.git, so linkRef always falls back to meta.branch. A detached-HEAD scan (every pull_request checkout, and local detached checkouts) now shows no file links at all. Acceptance criterion 3 ("HTML file links use the sha") is met only once #113 populates meta.git.sha. That is fine for a stacked merge, but don't release from this commit alone.
2. minor, CONFIRMED. src/upload.ts currentGitSha: the PR head from the payload wins for any event that has pull_request, including pull_request_target. On that event the default checkout is the base branch, so the scan of base code gets attributed to the PR head, and the quality-gate status lands on the PR for code it didn't scan. GITHUB_SHA is also read even when GITHUB_ACTIONS is unset, so an env leaked from a parent CI into a local run wins over the local HEAD. Both are fixed by #113's detectCiContext. Merge them together.
3. nit. The merge_group.json fixture is only exercised by #113's tests. Fine as is.

Not a problem:

• meta.branch = "" passes schema 0.5.0 (branch: z.string()).
• github-app's persistReport never reads meta.branch.
• The upload sha change matches what postQualityGateStatus expects (github-app/src/index.ts).