fix(ci): apply the pull request link to an already-compared scan pair

external_href is only honored while a diff scan is being created, so a
re-run over the same before/after pair left the Dashboard report with no
link back to its pull request. Send on_duplicate=update alongside it, which
applies the link to the existing diff scan and answers 200 with the same
envelope as a create.

The 409-and-resolve path is retained for runs with no pull request context
and for deployments that predate on_duplicate=update.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -22,6 +22,8 @@
   unless `--integration` is explicitly supplied.
 - Diff scans include the detected pull request or merge request URL as their
   external link, allowing Dashboard reports to retain their CI change context.
+  Re-running a comparison over an already-compared scan pair now applies the
+  link to the existing diff scan instead of leaving that report unassociated.
 
 ## 2.7.0
 

socketsecurity/core/__init__.py

@@ -1633,6 +1633,14 @@ def get_diff_scan_artifacts(
         }
         if external_href:
             create_params["external_href"] = external_href
+            # external_href is only honored while a diff scan is being created,
+            # so re-running a comparison over an already-compared scan pair
+            # would otherwise leave the Dashboard report with no link back to
+            # the pull request. on_duplicate=update applies the link to the
+            # existing resource and answers 200 with the same {"diff_scan": ...}
+            # envelope as a create. Notably it is not on_duplicate=redirect,
+            # whose 302 the SDK follows into a GET without cached=true.
+            create_params["on_duplicate"] = "update"
         try:
             result = self.sdk.diffscans.create_from_ids(self.config.org_slug, create_params)
             diff_scan = result.get("diff_scan") or {}
@@ -1641,11 +1649,14 @@ def get_diff_scan_artifacts(
             if error.status_code != 409:
                 raise
 
-            # Do not use on_duplicate=redirect here. The SDK follows that 302
-            # automatically with a GET that lacks cached=true, which can leave
-            # the connection idle while an existing diff scan is still computing.
-            # Resolve the duplicate resource explicitly so every result fetch
-            # continues through the bounded cached polling path below.
+            # Reached without on_duplicate=update (no pull request context to
+            # attach) and against deployments that predate it and still answer
+            # 409 regardless. Do not switch this to on_duplicate=redirect: the
+            # SDK follows that 302 automatically with a GET that lacks
+            # cached=true, which can leave the connection idle while an existing
+            # diff scan is still computing. Resolve the duplicate resource
+            # explicitly so every result fetch continues through the bounded
+            # cached polling path below.
             existing = self.sdk.diffscans.list(
                 self.config.org_slug,
                 params={

tests/core/test_diff_scan_polling.py

@@ -87,7 +87,8 @@ def test_duplicate_conflict_uses_cached_polling(core, diff_scan_get_response):
     artifacts = core.get_diff_scan_artifacts("head", "new")
 
     create_params = core.sdk.diffscans.create_from_ids.call_args.args[1]
-    assert "on_duplicate" not in create_params
+    # "redirect" is the unsafe value: its 302 is followed into an uncached GET.
+    assert create_params.get("on_duplicate") != "redirect"
     core.sdk.diffscans.list.assert_called_once_with(
         core.config.org_slug,
         params={
@@ -160,13 +161,59 @@ def test_eager_list_artifacts_do_not_bypass_filtered_get(core, diff_scan_get_res
         params={"cached": "true", "omit_unchanged": "true"},
     )
 
+
 def test_diff_scan_is_associated_with_pull_request_url(core):
     external_href = "https://dev.azure.com/acme/platform/_git/widgets/pullrequest/17"
 
     core.get_diff_scan_artifacts("head", "new", external_href=external_href)
 
     create_params = core.sdk.diffscans.create_from_ids.call_args.args[1]
     assert create_params["external_href"] == external_href
+    # Without this the link is dropped whenever the scan pair was compared before.
+    assert create_params["on_duplicate"] == "update"
+
+
+def test_no_duplicate_handling_requested_without_a_pull_request_url(core):
+    """Runs with no PR context keep the plain 409-and-resolve path."""
+    core.get_diff_scan_artifacts("head", "new")
+
+    create_params = core.sdk.diffscans.create_from_ids.call_args.args[1]
+    assert "on_duplicate" not in create_params
+    assert "external_href" not in create_params
+
+
+def test_updated_duplicate_is_polled_like_a_created_diff_scan(core, diff_scan_get_response):
+    """on_duplicate=update answers 200 with the create envelope, not a 409.
+
+    The existing scan must then flow through the same cached-polling path, and
+    the duplicate-resolving list call must not be needed at all.
+    """
+    core.sdk.diffscans.create_from_ids.return_value = {
+        "diff_scan": {"id": "existing-diff-scan"}
+    }
+
+    artifacts = core.get_diff_scan_artifacts(
+        "head", "new", external_href="https://github.com/acme/widgets/pull/42"
+    )
+
+    core.sdk.diffscans.list.assert_not_called()
+    assert core.sdk.diffscans.get.call_args.args[1] == "existing-diff-scan"
+    assert len(artifacts.added) > 0
+
+
+def test_link_falls_back_to_resolving_the_duplicate_on_older_deployments(core):
+    """Deployments predating on_duplicate=update still answer 409; keep working."""
+    core.sdk.diffscans.create_from_ids.side_effect = APIFailure(
+        "duplicate", status_code=409
+    )
+    core.sdk.diffscans.list.return_value = {"results": [{"id": "existing-diff-scan"}]}
+
+    artifacts = core.get_diff_scan_artifacts(
+        "head", "new", external_href="https://github.com/acme/widgets/pull/42"
+    )
+
+    assert core.sdk.diffscans.get.call_args.args[1] == "existing-diff-scan"
+    assert len(artifacts.added) > 0
 
 
 def test_fallback_to_streaming_diff_on_failure(core):

tests/unit/test_socketcli.py

@@ -4,7 +4,10 @@
 
 from socketsecurity import socketcli
 from socketsecurity.core.classes import Diff, Package
-from socketsecurity.socketcli import build_license_artifact_payload, should_write_comment
+from socketsecurity.socketcli import (
+    build_license_artifact_payload,
+    should_write_comment,
+)
 
 # ---------------------------------------------------------------------------
 # Exit-code-on-api-error (flag-only, non-breaking for 2.3.x).