[BUG] claude-security scan-changes reproducibly analyzes wrong diff content

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Follow-up to a previously drafted report on the same bug. Retried the scan-changes job (claude-security plugin) a second time, with a brand-new report directory and a brand-new Workflow run id (wf_73cca42c-76f, vs the first attempt's wf_326ad394-df4) -- ruling out simple per-run agent-cache replay as the cause.

Same wrong result both times: the inventory/research step reported analyzing .github/workflows/unit-tests.yml / instrumented-tests.yml, fabricating a placeholder Firebase google-services.json, and explicitly stated that the :base module "is unchanged by this commit range" -- both false for the actual range.

Verified before and after the retry that local git state exactly matches the GitHub remote (git rev-parse origin/master/HEAD == gh api .../branches/master|development .commit.sha), and confirmed via plain git diff --numstat <merge-base>..<HEAD> that the real diff is 18 files / 750 lines touching base/build.gradle, MainActivity.kt, BaseViewModel.kt, and several test files added/removed -- nothing under .github/workflows changed at all in this range.

Evidence:

• First attempt: run dir CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4
• Second (retry) attempt: run dir CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f
• Both scan-meta.json correctly recorded revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4, revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325
• Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private)

Suspected cause (not fully root-caused): ruled out stale local/remote git state and simple agent-result cache collision within one workflow run (fresh run id on retry gave the identical wrong result). Suspect the diff/range is being resolved or read via some path other than the exact two-sided range handed to Workflow(args.range), possibly picking up a different commit's content by file-path/theme similarity rather than the literal git range.

What Should Happen?

The scan-changes job should analyze the exact diff between the two commits/refs passed to Workflow(args.range) -- no more, no less. Concretely:

• Inventory/hotFiles should list only files that actually appear in git diff --numstat <merge-base>..<HEAD> for the requested range (here: base/build.gradle, MainActivity.kt, BaseViewModel.kt, and the added/removed test files).
• It should never surface content from files unrelated to the range (.github/workflows/unit-tests.yml, instrumented-tests.yml) just because a similarly-themed commit touching those files exists elsewhere in the repo's history.
• The :base module change-detection should correctly report "changed" whenever the requested range touches files under :base (it did here, and was wrongly reported as unchanged).
• Running the same range twice, with fresh run ids, should produce the same correct result each time -- not the same wrong one.

Error Messages/Logs

scan-meta.json (both runs) correctly recorded:
revision.merge_base=6073fdf8129ff75286743b1df20d2379c57254c4
revision.commit=0e7aa99ad5662f854059b70e059da0bb0aafe325

Run dirs:
CLAUDE-SECURITY-20260905-084249 / workflow run wf_326ad394-df4 (1st attempt)
CLAUDE-SECURITY-20260905-092735 / workflow run wf_73cca42c-76f (2nd attempt, retry)

Steps to Reproduce

1. In a repo where some other branch/PR history contains a commit touching CI YAML with a similarly-themed "generate dummy google-services.json" step, run the claude-security scan-changes job against an unrelated commit range that does NOT include that commit.
2. Observe the inventory/research step's component list and hotFiles.
3. It keeps citing that unrelated CI YAML content and fabricated google-services.json details regardless of the actual requested range, and misreports whether the :base module changed.
4. Retry with a fresh Workflow run id against the same range -- the wrong result reproduces identically.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.259 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Repo: github.com/carlosblagdev/contracciones_cronometradas_kotlin (private repo). Area: claude-security plugin, scan-changes job.