feat(pr_merge): gate it like tbd_ship — green CI, unprotected base, exactly one risk/low issue (#74) (#76)

Co-authored-by: Mathias <mthbqv@gmail.com>

internal/tools/tbd_ship_test.go

@@ -3,6 +3,7 @@ package tools_test
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -59,10 +60,12 @@ func shipFakeFull(t *testing.T, runsJSON string, requiredApprovals, mergeStatus
 			_, _ = w.Write([]byte(`{"content":{"path":"x","sha":"s"},"commit":{"sha":"c"}}`))
 		case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls"):
 			w.WriteHeader(http.StatusCreated)
-			_, _ = w.Write([]byte(`{"number":7,"title":"t","html_url":"http://x/pulls/7","state":"open","head":{"ref":"tbd/x","sha":"abc"},"base":{"ref":"main"}}`))
+			_, _ = w.Write([]byte(`{"number":7,"title":"t","html_url":"http://x/pulls/7","state":"open","head":{"ref":"tbd/x","sha":"` + shipPRHeadSha + `"},"base":{"ref":"main"}}`))
 		case r.Method == http.MethodGet && strings.Contains(p, "/actions/runs"):
 			_, _ = w.Write([]byte(`{"total_count":0,"workflow_runs":` + runsJSON + `}`))
 		case r.Method == http.MethodPost && strings.HasSuffix(p, "/pulls/7/merge"):
+			body, _ := io.ReadAll(r.Body)
+			shipLastMergeBody.Store(string(body))
 			merged.Store(true)
 			w.WriteHeader(mergeStatus)
 			_, _ = w.Write([]byte(`{}`))
@@ -216,6 +219,41 @@ func TestTBDShip_Resume_ExistingBranchAndPR(t *testing.T) {
 	assert.True(t, merged.Load())
 }
 
+// shipPRHeadSha is the head sha the fake reports for the PR it opens (tests may blank it, then restore it).
+var shipPRHeadSha = "abc"
+
+// shipLastMergeBody is the body of the most recent merge request the fake received.
+var shipLastMergeBody atomic.Value
+
+// An empty head sha used to unscope the CI query and drop the merge binding (review of PR #76). Fail closed.
+func TestTBDShip_AnEmptyHeadShaFailsClosed(t *testing.T) {
+	shipPRHeadSha = ""
+	t.Cleanup(func() { shipPRHeadSha = "abc" })
+	var merged, deleted atomic.Bool
+	srv := shipFake(t, shipGreen, &merged, &deleted)
+	defer srv.Close()
+
+	res := callShip(t, srv.URL, shipArgs)
+
+	assert.Equal(t, false, res["merged"])
+	assert.Contains(t, res["reason"], "head commit")
+	assert.False(t, merged.Load(), "an unknown head commit must never merge")
+}
+
+// TOCTOU: the merge is bound to the head commit whose CI the gate evaluated (gitea-mcp#74).
+func TestTBDShip_TheMergeIsBoundToTheCommitTheGateChecked(t *testing.T) {
+	var merged, deleted atomic.Bool
+	srv := shipFake(t, shipGreen, &merged, &deleted)
+	defer srv.Close()
+
+	res := callShip(t, srv.URL, shipArgs)
+
+	require.Equal(t, true, res["merged"])
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal([]byte(shipLastMergeBody.Load().(string)), &payload))
+	assert.Equal(t, "abc", payload["head_commit_id"], "the head sha the CI check used")
+}
+
 // ---- gitea-mcp#63: the risk tier is an input to the gate. Only exactly one risk/low label merges. ----
 const (
 	shipGreen = `[{"id":1,"status":"completed","conclusion":"success","head_sha":"abc"}]`