Include squash and diff head SHA in Chain of Custody report

In align with the Compliance dashboard, the Chain of Custody
report lists the squash and diff head SHA to handle
when the merge request was fast-forwarded.

doc/user/compliance/compliance_dashboard/index.md

@@ -68,6 +68,7 @@ project to make sure it complies with the separation of duties described above.
 The Chain of Custody report allows customers to export a list of merge commits within the group.
 The data provides a comprehensive view with respect to merge commits. It includes the merge commit SHA,
 merge request author, merge request ID, merge user, pipeline ID, group name, project name, and merge request approvers.
+Depending on the merge strategy, the merge commit SHA can either be a merge commit, squash commit or a diff head commit.
 
 To download the Chain of Custody report, navigate to **{shield}** **Security & Compliance > Compliance** on the group's menu and click **List of all merge commits**
 

ee/app/services/merge_commits/export_csv_service.rb

@@ -45,7 +45,7 @@ module MergeCommits
 
     def header_to_value_hash
       {
-        'Merge Commit' => 'merge_commit_sha',
+        'Merge Commit' => 'merged_commit_sha',
         'Author' => -> (merge_request) { merge_request.author&.name },
         'Merge Request' => 'id',
         'Merged By' => -> (merge_request) { merge_request.metrics&.merged_by&.name },

ee/changelogs/unreleased/merged-commit-csv.yml

+---
+title: Include squash and diff head SHA in Chain of Custody report
+merge_request: 47429
+author:
+type: changed

ee/spec/services/merge_commits/export_csv_service_spec.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe MergeCommits::ExportCsvService do
-  subject { described_class.new(user, group) }
+  let(:service) { described_class.new(user, group) }
 
   let_it_be(:group) { create(:group, name: 'Kombucha lovers') }
   let_it_be(:user) { create(:user, name: 'John Cena') }
@@ -18,7 +18,7 @@ RSpec.describe MergeCommits::ExportCsvService do
     project.add_maintainer(user)
   end
 
-  it { expect(subject.csv_data).to be_success }
+  it { expect(service.csv_data).to be_success }
 
   it 'includes the appropriate headers' do
     expect(csv.headers).to eq(['Merge Commit', 'Author', 'Merge Request', 'Merged By', 'Pipeline', 'Group', 'Project', 'Approver(s)'])
@@ -65,9 +65,9 @@ RSpec.describe MergeCommits::ExportCsvService do
 
     context 'by commit_sha filter' do
       context 'when valid' do
-        subject { described_class.new(user, group, { commit_sha: merge_request_2.merge_commit_sha }) }
+        let(:service) { described_class.new(user, group, { commit_sha: merge_request_2.merge_commit_sha }) }
 
-        it { expect(subject.csv_data).to be_success }
+        it { expect(service.csv_data).to be_success }
 
         it { expect(csv.count).to eq 1 }
 
@@ -77,15 +77,35 @@ RSpec.describe MergeCommits::ExportCsvService do
       end
 
       context 'when merge commit does not exist' do
-        subject { described_class.new(user, group, { commit_sha: 'inexistent' }) }
+        let(:service) { described_class.new(user, group, { commit_sha: 'inexistent' }) }
 
         it { expect(csv.count).to eq 0 }
       end
     end
   end
 
+  context 'possible merge commit SHA values' do
+    subject { csv[1]['Merge Commit'] }
+
+    context 'when squash_commit_sha is present' do
+      let_it_be(:squash_commit_merge_request) do
+        create(:merged_merge_request, squash_commit_sha: 'f7ce827c314c9340b075657fd61c789fb01cf74d', source_project: project, target_project: project, state: :merged)
+      end
+
+      it { is_expected.to eq squash_commit_merge_request.squash_commit_sha }
+    end
+
+    context 'when diff_head_sha is present' do
+      let_it_be(:diff_head_merge_request) do
+        create(:merge_request_with_diffs, source_project: project, target_project: project, state: :merged)
+      end
+
+      it { is_expected.to eq diff_head_merge_request.diff_head_sha }
+    end
+  end
+
   def csv
-    data = subject.csv_data.payload
+    data = service.csv_data.payload
 
     CSV.parse(data, headers: true)
   end