🐛 Fall back when check suites are truncated

[ECD5A]

What kind of change does this PR introduce?

Bug fix.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

GitHub GraphQL check-suite results are cached even when the checkSuites connection is truncated.

When a commit has more check suites than the GraphQL query returns, the partial result is treated as complete. Because the commit SHA is present in the cache, listCheckRunsForRef does not use its existing REST fallback.

As a result, successful CI check runs located after the first GraphQL page can be missed by the CI-Tests and SAST checks.

What is the new behavior (if this is a feature change)?

The GitHub client now reads PageInfo.HasNextPage from the checkSuites connection.

When the GraphQL result is truncated, the pull request head SHA is not added to the check-run cache. This produces a cache miss and allows the existing REST fallback to retrieve the check runs for that ref.

A regression test verifies that truncated GraphQL data triggers the REST fallback and returns a successful github-actions check run.

• Tests for the changes have been added

Which issue(s) this PR fixes

Fixes #5149

Special notes for your reviewer

The branch contains one DCO-signed commit.

Fork validation results:

• build: passed
• docker-build: passed
• golangci-lint: passed
• gitlab-tests: passed
• PR title uses the required :bug: prefix

The fork's Dependency Review workflow could not run because Dependency Graph is not enabled on the fork.

The integration workflow reported two unrelated failures in e2e/vulnerabilities_test.go. The live OSV response returned three vulnerability warnings and score 7, while the test fixture expected four warnings and score 6. The other 58 executed integration specifications passed. This change does not modify vulnerability-related code.

Does this PR introduce a user-facing change?

Scorecard now falls back to the GitHub REST API when GraphQL check-suite results are truncated, preventing CI-Tests and SAST from missing successful check runs.

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-08-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---