In align with the Compliance dashboard, the Chain of Custody
report lists the squash and diff head SHA to handle
when the merge request was fast-forwarded.