fix: checkout-verif uses wrong sha to validate for pull_requests (#941)

* update * update
slsa-framework · Sep 30, 2022 · fc65005 · fc65005
1 parent b075c0c
commit fc65005
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/.github/actions/verify-checkout/action.yaml b/.github/actions/verify-checkout/action.yaml
@@ -8,12 +8,19 @@ runs:
       shell: bash
       env:
         CONTEXT: "${{ toJSON(github) }}"
+        PULL_REQUEST_SHA: "${{ github.event.pull_request.head.sha }}"
       run: |
         set -euo pipefail
 
-        git_sha=$(git log -1 --format='%H')
-        if [[ "$git_sha" != "$GITHUB_SHA" ]]; then
-            echo "mismatch git sha \"$git_sha\" != \"$GITHUB_SHA\""
+        git_sha="$(git log -1 --format='%H')"
+        github_sha="$GITHUB_SHA"
+
+        if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+          github_sha="$PULL_REQUEST_SHA"
+        fi
+
+        if [[ "$git_sha" != "$github_sha" ]]; then
+            echo "mismatch git sha \"$git_sha\" != \"$github_sha\""
             echo "GitHub context:"
             echo "$CONTEXT"
             echo