Ensure tests checkout PR branch (#1441)

* Ensure tests checkout PR branch

If not explicit, on some PR or push events it might checkout main
instead, which is not what we want on PR tests.

* Fix it to PR head SHA

* Reverse label/unlabel events

* trigger on labeled always change

* trigger on labeled/unlabeled only on regular PRs

Author: josvazg

.github/actions/build-push-image/action.yaml

@@ -76,7 +76,7 @@ runs:
         cache: false
     - name: Setup cache
       if: ${{ inputs.get-existing-cache == 'false' }}
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cache/go-build

.github/workflows/check-licenses.yml

@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Cache multiple paths
         uses: actions/cache@v4

.github/workflows/cloud-tests-filter.yml

@@ -18,6 +18,8 @@ jobs:
           run-cloud-tests: ${{ steps.tests-filter.outputs.run-cloud-tests }}
         steps:
         - uses: actions/checkout@v4
+          with:
+            ref: ${{github.event.pull_request.head.sha}}
         - uses: dorny/paths-filter@v3
           id: paths-filter
           with:

.github/workflows/lint.yaml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Setup Go
         uses: actions/setup-go@v5

.github/workflows/openshift-upgrade-test.yaml

@@ -36,6 +36,7 @@ jobs:
         name: Check out code
         uses: actions/checkout@v4
         with:
+          ref: ${{github.event.pull_request.head.sha}}
           fetch-depth: 0 # required for tags
       - if: ${{ inputs.forked == true }}
         name: Check out code

.github/workflows/test-e2e.yml

@@ -20,6 +20,7 @@ jobs:
         name: Check out code
         uses: actions/checkout@v4
         with:
+          ref: ${{github.event.pull_request.head.sha}}
           submodules: true
           fetch-depth: 0
       - if: ${{ inputs.forked == true }}
@@ -55,6 +56,7 @@ jobs:
         name: Check out code
         uses: actions/checkout@v4
         with:
+          ref: ${{github.event.pull_request.head.sha}}
           submodules: true
           fetch-depth: 0
       - if: ${{ inputs.forked == true }}
@@ -168,6 +170,7 @@ jobs:
         if: steps.get-repo-files-from-cache.outputs.cache-hit != 'true'
         uses: actions/checkout@v4
         with:
+          ref: ${{github.event.pull_request.head.sha}}
           submodules: true
           fetch-depth: 0
       - name: Get all go dependencies

.github/workflows/test-int.yml

@@ -28,6 +28,8 @@ jobs:
       - if: ${{ inputs.forked == false }}
         name: Check out code
         uses: actions/checkout@v4
+        with:
+          ref: ${{github.event.pull_request.head.sha}}
 
       - if: ${{ inputs.forked == true }}
         name: Check out code

.github/workflows/test-unit.yml

@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Cache multiple paths
         uses: actions/cache@v4

.github/workflows/test.yml

@@ -7,13 +7,12 @@ on:
     paths-ignore:
       - 'docs/**'
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, unlabeled]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, labeled, unlabeled]
     branches:
       - '**'
     paths-ignore:
       - 'docs/**'
-  pull_request_target: # for forked repos changes labeled 'safe-to-test' or 'cloud-tests'
-    types: [labeled]
+  pull_request_target:
     paths-ignore:
       - 'docs/**'
   merge_group:

.github/workflows/validate-manifests.yml

@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{github.event.pull_request.head.sha}}
 
       - name: Cache multiple paths
         uses: actions/cache@v4