Back to restricted SHA

Author: omus

.github/workflows/integration-tests.yaml

@@ -44,8 +44,6 @@ jobs:
             from-scratch: true
           - title: Head Commit
             commit-sha: ${{ github.event.pull_request.head.sha }}
-          - title: Fixed Commit
-            commit-sha: 5921a42f27af154dec1372cb1e1d1fe11c701437
     steps:
       - name: Job started at
         id: job-started

action.yaml

@@ -35,7 +35,7 @@ outputs:
     value: ${{ steps.tags.outputs.json }}
   commit-sha:
     description: The Git commit SHA used to build the image.
-    value: ${{ steps.commit-head.outputs.sha }}
+    value: ${{ steps.commit.outputs.sha }}
 runs:
   using: composite
   steps:
@@ -48,14 +48,26 @@ runs:
     # https://github.com/docker/metadata-action/issues/206
     # https://github.com/docker/metadata-action/issues/362
     - name: Determine commit SHA
-      id: commit-head
+      id: commit
       shell: bash
       run: |
         # Determine commit SHA
         sha="$(git rev-parse HEAD)"
-        short_sha="$(git rev-parse --short "$sha")"
         echo "sha=$sha" | tee -a "$GITHUB_OUTPUT"
-        echo "short-sha=$short_sha" | tee -a "$GITHUB_OUTPUT"
+
+        case "$sha" in
+            "${{ github.event.pull_request.head.sha }}")
+                is_pr_head_sha=true
+                ;;
+            "${{ github.sha }}")
+                is_pr_head_sha=false
+                ;;
+            *)
+                echo "Context uses unexpected commit SHA" >&2
+                exit 1
+                ;;
+        esac
+        echo "is-pr-head-sha=${is_pr_head_sha}" | tee -a "$GITHUB_OUTPUT"
     # Optional branch name (e.g. "main") for workflows triggered by `pull_request` or `push` events.
     - name: Branch
       id: branch
@@ -72,9 +84,12 @@ runs:
         images: |
           ${{ inputs.image-repository }}
         tags: |
-          type=raw,prefix=sha-,value=${{ steps.commit-head.outputs.short-sha }}
+          type=sha,prefix=sha-,format=short
           type=ref,prefix=pr-,event=pr
           type=raw,prefix=branch-,value=${{ steps.branch.outputs.name }},enable=${{ steps.branch.outputs.name != '' }}
+      env:
+        # https://github.com/docker/metadata-action/issues/206
+        DOCKER_METADATA_PR_HEAD_SHA: ${{ steps.commit.outputs.is-pr-head-sha }}
     # Use separate cache images to avoid bloating final images
     # https://docs.docker.com/build/cache/backends/registry/
     - name: Docker cache-from
@@ -85,18 +100,24 @@ runs:
         images: |
           ${{ inputs.image-repository }}
         tags: |
-          type=raw,prefix=cache-sha-,value=${{ steps.commit-head.outputs.sha }}
+          type=sha,prefix=cache-sha-,format=long
           type=raw,prefix=cache-branch-,value=${{ steps.branch.outputs.name }},enable=${{ steps.branch.outputs.name != '' }}
           type=raw,prefix=cache-sha-,value=${{ github.event.pull_request.base.sha }},enable=${{ github.event_name == 'pull_request' }}
+      env:
+        # https://github.com/docker/metadata-action/issues/206
+        DOCKER_METADATA_PR_HEAD_SHA: ${{ steps.commit.outputs.is-pr-head-sha }}
     - name: Docker cache-to
       id: cache-to
       uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
       with:
         images: |
           ${{ inputs.image-repository }}
         tags: |
-          type=raw,prefix=cache-sha-,value=${{ steps.commit-head.outputs.sha }}
+          type=sha,prefix=cache-sha-,format=long
           type=raw,prefix=cache-branch-,value=${{ steps.branch.outputs.name }},enable=${{ steps.branch.outputs.name != '' }}
+      env:
+        # https://github.com/docker/metadata-action/issues/206
+        DOCKER_METADATA_PR_HEAD_SHA: ${{ steps.commit.outputs.is-pr-head-sha }}
     # Disable environmental variables set by `docker/metadata-action`:
     # https://github.com/docker/metadata-action#outputs
     # https://github.com/docker/metadata-action/issues/490