Pull Request Handler - Use Github SHA if possible #1130
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
With
github.event.pull_request.merge_commit_sha
we're not guaranteed to get all the latest changes from the head branch included in the build. Often we only get the changes from the second last commit actions/checkout#518 (comment)Previously we used the merge branch but with the merge branch it's possible to push new changes to a PR from a forked repo and have the PR Build run on unapproved changes.
Proposed Solution
Use Github SHA if possible in the PR Build. Otherwise use the merge branch.
The pull_request trigger will use the github_sha which is the last merge commit on the GITHUB_REF branch. Thereby it should not be possible for the PR Build to run on unapproved changes.
The pull_request_target trigger cannot use the github_sha because it is the last commit on the PR base branch. Instead we'll use the merge branch. With the pull_request_target trigger PR Builds are always triggered right away which means we'll cancel any currently running PR Build once there's a new push to the PR.