archetech / archon / 33204106436

87%

push

github

fix(ci): Stamp images with the commit they were built from (#959)

`github.sha` on a workflow_dispatch is the branch carrying the workflow
file, not the ref being built. I wired inputs.ref through to the
checkout and stopped there, so the v0.12.0 backfill built the right
source and labelled it with main's commit:

  org.opencontainers.image.version:  v0.12.0
  org.opencontainers.image.revision: 5929fb5e   (main, not c9b76eff)

The same value reaches GIT_COMMIT, which the services report at runtime,
so those images answer with a commit they do not contain. That is the
provenance problem this repo has spent time untangling from the other
end, reintroduced at the source.

The commit now comes from `git rev-parse HEAD` after checkout, which is
equal to github.sha on a push and correct on a dispatch. The revision
label is set explicitly rather than left to metadata-action, which
derives it from the event for the same reason.

Guarded: no expression in this workflow may reference github.sha, and
both the build arg and the revision label must come from the recorded
sha. Restoring either fails it.

This is the second step in this file to assume something about its
trigger and be wrong once the trigger changed -- the first dropped QEMU
by inheriting a single-platform template. Adding a trigger means
auditing what the existing steps assumed about the old one.

3880 of 4464 branches covered (86.92%)

Branch coverage included in aggregate %.

8527 of 8952 relevant lines covered (95.25%)

717.66 hits per line