Address Copilot review feedback

- Only set CI_* vars when source env var is non-empty
- Fix comment: vars are build args in Docker, env vars in buildpacks
- Explicitly unset CODEBUILD_WEBHOOK_HEAD_REF in fallback test for determinism

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ipmb

builder/build/build.go

@@ -38,11 +38,18 @@ func (b *Build) LoadBuildEnv() (map[string]string, error) {
 	if val, ok := os.LookupEnv("ALLOW_EOL_SHIMMED_BUILDER"); ok {
 		env["ALLOW_EOL_SHIMMED_BUILDER"] = val
 	}
-	// map CodeBuild-specific vars to neutral CI vars and pass as build args
-	env["CI_COMMIT_REF"] = GetenvFallback([]string{"CODEBUILD_WEBHOOK_HEAD_REF", "CODEBUILD_SOURCE_VERSION"})
-	env["CI_COMMIT_SHA"] = os.Getenv("CODEBUILD_RESOLVED_SOURCE_VERSION")
-	env["CI_BUILD_STARTED_AT"] = os.Getenv("CODEBUILD_START_TIME")
-	env["CI_REPOSITORY_URL"] = os.Getenv("CODEBUILD_SOURCE_REPO_URL")
+	// map CodeBuild-specific vars to neutral CI vars and pass into Docker builds as build args
+	// and into buildpack builds as env vars
+	for k, v := range map[string]string{
+		"CI_COMMIT_REF":       GetenvFallback([]string{"CODEBUILD_WEBHOOK_HEAD_REF", "CODEBUILD_SOURCE_VERSION"}),
+		"CI_COMMIT_SHA":       os.Getenv("CODEBUILD_RESOLVED_SOURCE_VERSION"),
+		"CI_BUILD_STARTED_AT": os.Getenv("CODEBUILD_START_TIME"),
+		"CI_REPOSITORY_URL":   os.Getenv("CODEBUILD_SOURCE_REPO_URL"),
+	} {
+		if v != "" {
+			env[k] = v
+		}
+	}
 	params, err := b.aws.GetParametersByPath(paths[0])
 	stripParamPrefix(params, paths[0], &env)
 	if err != nil {

builder/build/build_test.go

@@ -127,6 +127,7 @@ func TestLoadBuildEnvCIVarsFallback(t *testing.T) {
 	mockedState := emptyState()
 	mockedState.On("ReadEnvFile").Return(&map[string]string{}, nil)
 
+	t.Setenv("CODEBUILD_WEBHOOK_HEAD_REF", "")
 	t.Setenv("CODEBUILD_SOURCE_VERSION", "refs/heads/feature-branch")
 
 	b := Build{