fix: use PR head branch for rules-ref instead of merge ref (#168)

For pull_request events, CodeBuild runs in detached HEAD so
git symbolic-ref fails. The fallback was GH_REF_NAME which
resolves to '155/merge' — a virtual GitHub ref that cannot
be cloned as a branch. Pass github.head_ref into the buildspec
as GH_HEAD_REF and prefer it in the fallback chain so the
evaluator clones the actual PR source branch.

Author: Kalindi-Dev

.github/workflows/codebuild.yml

@@ -173,6 +173,7 @@ jobs:
               variables:
                 GH_TOKEN: ${{ github.token }}
                 GH_REF_NAME: ${{ github.ref_name }}
+                GH_HEAD_REF: ${{ github.head_ref }}
                 GH_EVENT_NAME: ${{ github.event_name }}
             phases:
               install:
@@ -190,7 +191,7 @@ jobs:
               build:
                 commands:
                   - DEFAULT_BRANCH=$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null || echo "main")
-                  - CURRENT_BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null || echo "${GH_REF_NAME:-}")
+                  - CURRENT_BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null || echo "${GH_HEAD_REF:-${GH_REF_NAME:-}}")
                   - CURRENT_TAG=$(git describe --tags --exact-match 2>/dev/null || echo "")
                   - IS_RELEASE=$([[ -n "$CURRENT_TAG" ]] && echo "true" || echo "false")
                   - IS_PRE_RELEASE=$([[ "$CURRENT_BRANCH" == "$DEFAULT_BRANCH" ]] && echo "true" || echo "false")