fix(ci): execute Server Tests on exact PR heads

.github/workflows/codeql-required.yml

@@ -0,0 +1,56 @@
+name: CodeQL Required
+
+on:
+  # No base-branch filter: stacked PRs target feature branches, and their
+  # exact contributor heads still require CodeQL evidence before integration.
+  pull_request:
+  push:
+    branches: ["develop", "master"]
+  schedule:
+    - cron: "15 2 * * 6"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-required-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - javascript-typescript
+          - python
+    steps:
+      - name: Checkout exact revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify exact checkout
+        env:
+          EXPECTED_CHECKOUT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_CHECKOUT_SHA"
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          category: "/language:${{ matrix.language }}"
+          upload: never
+          upload-database: false

.github/workflows/dependency-review.yml

@@ -16,16 +16,47 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout exact revision
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
 
+      - name: Verify exact checkout
+        env:
+          EXPECTED_CHECKOUT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_CHECKOUT_SHA"
+
+      - name: Resolve current protected base revision
+        id: resolve_live_base
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$BASE_REF"
+
+          result="$(git ls-remote --exit-code origin "refs/heads/$BASE_REF")"
+          mapfile -t live_base_matches <<<"$result"
+          test "${#live_base_matches[@]}" -eq 1
+          read -r live_base_sha live_base_ref extra <<<"${live_base_matches[0]}"
+          test "$live_base_ref" = "refs/heads/$BASE_REF"
+          test -z "${extra:-}"
+          printf '%s\n' "$live_base_sha" | grep -Eq '^[0-9a-f]{40}$'
+
+          echo "Resolved refs/heads/$BASE_REF to $live_base_sha for dependency comparison"
+          echo "base_sha=$live_base_sha" >>"$GITHUB_OUTPUT"
+
       - name: Check dependency review support
         id: dependency_review_support
         env:
           GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BASE_SHA: ${{ steps.resolve_live_base.outputs.base_sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           REPOSITORY: ${{ github.repository }}
         shell: bash
@@ -38,35 +69,52 @@ jobs:
             exit 0
           fi
 
+          test -n "$BASE_SHA"
+          test -n "$HEAD_SHA"
+
           api_url="${GITHUB_API_URL:-https://api.github.com}"
+          relationship_file="$(mktemp)"
           response_file="$(mktemp)"
-          status="$(
-            curl -fsS -o "$response_file" -w '%{http_code}' \
+          trap 'rm -f "$relationship_file" "$response_file"' EXIT
+
+          relationship_http_status="$(
+            curl -sS -o "$relationship_file" -w '%{http_code}' \
               -H "Accept: application/vnd.github+json" \
               -H "Authorization: Bearer ${GH_TOKEN}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}" \
-              || true
+              "${api_url}/repos/${REPOSITORY}/compare/${BASE_SHA}...${HEAD_SHA}"
           )"
+          if [ "$relationship_http_status" != "200" ]; then
+            echo "::error::Live-base ancestry evidence is unavailable (HTTP ${relationship_http_status})."
+            exit 1
+          fi
 
-          if [ "$status" = "200" ]; then
-            echo "supported=true" >>"$GITHUB_OUTPUT"
-            exit 0
+          comparison_status="$(jq -er '.status' "$relationship_file")"
+          if [ "$comparison_status" != "ahead" ] && [ "$comparison_status" != "identical" ]; then
+            echo "::error::Exact contributor head does not contain the resolved live protected base (status: ${comparison_status}). Refresh the branch before interpreting dependency differences."
+            exit 1
           fi
 
-          if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::Dependency review is unavailable for ${REPOSITORY}; skipping dependency-review hard gate."
-            echo "supported=false" >>"$GITHUB_OUTPUT"
-            exit 0
+          status="$(
+            curl -sS -o "$response_file" -w '%{http_code}' \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GH_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}"
+          )"
+
+          if [ "$status" != "200" ]; then
+            echo "::error::Dependency review comparison evidence is unavailable (HTTP ${status})."
+            exit 1
           fi
 
-          echo "::error::Dependency review support check failed with HTTP ${status}."
-          cat "$response_file"
-          exit 1
+          echo "supported=true" >>"$GITHUB_OUTPUT"
 
       - name: Dependency review
         if: steps.dependency_review_support.outputs.supported == 'true'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
+          base-ref: ${{ steps.resolve_live_base.outputs.base_sha }}
+          head-ref: ${{ github.event.pull_request.head.sha }}
           fail-on-severity: moderate
           comment-summary-in-pr: on-failure

.github/workflows/fuzz.yml

@@ -35,10 +35,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
 
+      - name: Verify exact checkout
+        env:
+          EXPECTED_CHECKOUT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_CHECKOUT_SHA"
+
       - name: Set up Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22.13.0'
           cache: 'npm'
@@ -49,14 +57,12 @@ jobs:
       - name: Select iteration budget
         id: budget
         shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_FUZZ_RUNS: ${{ github.event.inputs.fuzz_runs }}
         run: |
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            echo "runs=200000" >> "$GITHUB_OUTPUT"
-          elif [ -n "${{ github.event.inputs.fuzz_runs }}" ]; then
-            echo "runs=${{ github.event.inputs.fuzz_runs }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "runs=20000" >> "$GITHUB_OUTPUT"
-          fi
+          runs="$(bash scripts/ci/select_fuzz_budget.sh "$EVENT_NAME" "$INPUT_FUZZ_RUNS")"
+          printf 'runs=%s\n' "$runs" >> "$GITHUB_OUTPUT"
 
       - name: Run property fuzz targets
         env: