fix: use commit SHA for autofix checkout to survive deleted PR branches

.github/workflows/codeql.yml

@@ -26,9 +26,9 @@
 #          dependencies.
 # cspell:ignore SARIF autofixers pipefail pyproject Pipfile noninteractive sarif venv mapfile
 
 name: "CodeQL Advanced"
 
 on:
   push:
     branches: ["main"]
     paths-ignore:
@@ -123,7 +123,7 @@
           git fetch --no-tags --depth=1 origin "$BASE_REF" || true
           files=$(git diff --name-only "origin/$BASE_REF...HEAD" || true)
           echo "::debug::Files changed in PR: $files"
           if echo "$files" | grep -E -q '(^|/)(package.json|package-lock.json|yarn.lock|pyproject.toml|requirements(\.txt)?|Pipfile|setup\.py|poetry.lock|go.mod|Gemfile|pom.xml)'; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
@@ -469,7 +469,7 @@
         continue-on-error: true
         run: |
           set -euo pipefail
           mapfile -t files < <(git ls-files -- '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' ':(exclude).github/workflows/**' 2>/dev/null || true)
           if [ "${#files[@]}" -gt 0 ]; then
             clang-format -i --style=file --fallback-style=LLVM "${files[@]}" || true
           else
@@ -492,6 +492,7 @@
         if: steps.diff.outputs.changed == 'true' && github.event_name == 'pull_request' && steps.ref.outputs.can_push == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUSH_REF: ${{ steps.ref.outputs.push_ref }}
         run: |
           set -euo pipefail
           git config user.name  "github-actions[bot]"
@@ -590,7 +591,7 @@
             - `eslint --fix` (if configured in the repository)
             - `clang-format -i --style=file` (when C/C++ files are present)
 
             Triggered by: `${{ github.event_name }}` on `${{ github.ref }}` (run [#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})).
           labels: |
             automated
             autofix

tests/test_codeql_workflow_paths_ignore.py

@@ -28,6 +28,25 @@ def test_codeql_autofix_ref_step_avoids_unbound_shell_vars() -> None:
     assert 'echo "can_push=$can_push_value"' not in content
 
 
+@pytest.mark.unit
+def test_codeql_autofix_uses_sha_for_checkout_and_branch_for_push() -> None:
+    """Verify the autofix job uses SHA for checkout (resilient to branch deletion)
+    and a separate push_ref for the git push step (uses branch name)."""
+    workflow_path = Path(__file__).resolve().parents[1] / ".github" / "workflows" / "codeql.yml"
+    content = workflow_path.read_text(encoding="utf-8")
+
+    # The "Determine checkout ref" step must expose PR_HEAD_SHA for checkout
+    assert "PR_HEAD_SHA" in content, "PR_HEAD_SHA env var must be set in the ref step"
+    assert 'echo "ref=$PR_HEAD_SHA"' in content, "checkout ref must use SHA, not branch name"
+    assert 'echo "push_ref=$PR_HEAD_REF"' in content, "push_ref must preserve the branch name"
+
+    # The push step must use push_ref (branch name), not ref (SHA)
+    assert 'steps.ref.outputs.push_ref' in content, "git push must target push_ref (branch name)"
+    # push_ref is surfaced via PUSH_REF env var to keep shell script clean
+    assert 'PUSH_REF: ${{ steps.ref.outputs.push_ref }}' in content, "PUSH_REF env var must map push_ref"
+    assert 'HEAD:$PUSH_REF' in content, "push must use PUSH_REF env var (branch name)"
+
+
 @pytest.mark.unit
 def test_codeql_autofix_excludes_workflow_files_from_formatting() -> None:
     repo_root = Path(__file__).resolve().parents[1]