action is not respecting checkout ref for version

[rh0dium]

Behaviour

We have found that metadata-action is not respecting the checked out reference sha (actions/checkout: ref) but is using the base CI actions SHA. We have a flow were we auto tag and release (which does update a couple version files) based on a number of criteria. The idea is to then check out that new tagged release and build and deploy based off of that.

However we have found that metadata-action points back to the base sha. How can we use our new reference sha?

Steps to reproduce this issue

1. Push a change into CI. (Incoming SHA - 7ed240f)
2. Our CI Flow based on a number of criteria will auto trigger a release. This release will update a handful of non-essential version files. This create a new SHA (Updated SHA 495803)
3. Updated SHA then passed as the ref to the docker build which is checked out.
4. In inspecting the Metadata output metadata/acdtion is NOT using this Updated SHA but rather the incoming SHA (7ed240f).

Expected behaviour

I would expect that the metadata tags and labels would use the checked reference of the checkout.

Actual behaviour

Uses the default incoming CI trigger sha

Configuration

  docker-push:
    runs-on: ubuntu-latest
    needs: [  release ]
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2
        with:
          ref: ${{needs.release.outputs.bump_sha}}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Collect Metadata
        uses: docker/metadata-action@v3
        with:
          images: pivotalenergy/mysqldb
          flavor: |
            latest=auto
          tags: |
            type=match,pattern=\d.\d.\d
            type=match,pattern=\d.\d
            type=ref,event=pr
            type=sha

Logs

2_Checkout Code.txt
4_Collect Metadata.txt

[crazy-max]

Yes this is currently tracked in #139