repo to test if i can abuse permissions of compiled PR time code scans by codeql to upload sarif with a non PR branch ref