Make deploy steps for an app all use the same commit

.github/actions/build-release-image/action.yml

@@ -18,12 +18,19 @@ outputs:
 runs:
   using: "composite"
   steps:
+    - id: set-image-tag
+      shell: bash
+      run: |
+        # not strictly required as long as the calling workflow has checked out
+        # the repo with the correct ref, but for good measure and making this
+        # composite action not have a hard requirement on the git repo, we can
+        # set the tag to the specified commit hash
+        echo "IMAGE_TAG=${{ inputs.commit_hash }}" >> "$GITHUB_ENV"
 
     - id: get-image-identifier
       shell: bash
       run: |
         IMAGE_NAME=$(make APP_NAME=${{ inputs.app_name }} release-image-name)
-        IMAGE_TAG=$(make release-image-tag)
         echo "image=$IMAGE_NAME:$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
     - name: Set up Docker Buildx

.github/workflows/build-and-publish.yml

@@ -61,7 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.ref }}
+          ref: ${{ needs.get-commit-hash.outputs.commit_hash }}
 
       - name: Set up Terraform
         uses: ./.github/actions/setup-terraform

.github/workflows/cd-{{app_name}}.yml.jinja

@@ -1,7 +1,7 @@
 name: Deploy {{ app_name }}
 # Need to set a default value for when the workflow is triggered from a git push
 # which bypasses the default configuration for inputs
-run-name: Deploy ${{'{{'}}inputs.version || 'main' {{'}}'}} to {{ app_name }} ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
+run-name: Deploy ${{'{{'}} inputs.version || github.sha {{'}}'}} to {{ app_name }} ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
 
 on:
   {% if app_has_dev_env_setup %}
@@ -51,5 +51,5 @@ jobs:
     with:
       app_name: "{{ app_name }}"
       environment: ${{'{{'}} inputs.environment || 'dev' {{'}}'}}
-      version: ${{'{{'}} inputs.version || 'main' {{'}}'}}
+      version: ${{'{{'}} inputs.version || github.sha {{'}}'}}
     secrets: inherit