Understand sneaky test failure

[surchs]

In both JS repos we now have seen the same problem:

• dependabot makes a bump PR that looks good (all tests green)
  • annotator: Bump core-js from 3.35.0 to 3.35.1 annotation_tool#678 and e2e tests: https://github.com/neurobagel/annotation_tool/actions/runs/7658271831/job/20870828544
  • query: Bump @typescript-eslint/parser from 8.13.0 to 8.14.0 query-tool#360 and e2e tests: https://github.com/neurobagel/query-tool/actions/runs/7613716952/job/20734276950
• but once the PR is merged, the CI breaks on main:
  • annotator: https://github.com/neurobagel/query-tool/actions/runs/7658267746/job/20870817630
  • query: https://github.com/neurobagel/annotation_tool/actions/runs/7659056257/job/20873327373

From https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request, specifically from

Note that GITHUB_SHA for this event is the last merge commit of the pull request merge branch. If you want to get the commit ID for the last commit to the head branch of the pull request, use github.event.pull_request.head.sha instead.

we know that the CI is not running on the HEAD commit of the PR branch, but on a (hidden) merge of the PR with main. So in other words: the CI run before and immediately after merging should behave exactly the same. But here we are and they do not 😕

So something that we thought we understood reasonably well is doing something unexpected -> we need to find out why that happens and if we have incorrect assumptions / understanding.