refactor: harden tests

.github/workflows/codeql.yml

@@ -2,6 +2,12 @@ name: "CodeQL"
 
 on:
   workflow_call:
+    inputs:
+      checkout_ref:
+        description: Optional commit to check out instead of the triggering ref
+        required: false
+        type: string
+        default: ""
   push:
     branches: ["main"]
   pull_request:
@@ -32,6 +38,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        with:
+          ref: ${{ inputs.checkout_ref }}
 
       - name: Set up pnpm package manager
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 #v6.0.9