Use correct commit sha for PRs?

Behaviour

Hey folks, similar to https://github.com/docker/metadata-action/issues/191 a bit, when running a workflow on a PR event, the {{ sha }} refers to the temporary merge commit to the target branch, not the commit that was pushed to trigger the event.

I realize this is a pretty common situation with GitHub actions, but it ends up with Docker tags/labels that don’t map back to any real commits. It would be really useful if this action automatically used github.event.pull_request.head.sha for PR events. I think it would have to be set for the tags {{ sha }} value and the auto-generated label org.opencontainers.image.revision.

I’m aware we can work around the tags situation by using type=raw and passing a value based on github.event.pull_request.head.sha, but it feels a bit error-prone.

I’m unaware of a workaround for overriding the org.opencontainers.image.revision label, though.

Steps to reproduce this issue

See example workflow and run on a PR

Expected behaviour

Tags with the correct sha in a PR (same with org.opencontainers.image.revision label)

Actual behaviour

Tags are created with the merge commit of the PR to the target branch (same with org.opencontainers.image.revision)

name: AWS

on:
  push:
    branches: ["main"]
    tags: ["v*"]
  pull_request:
    branches: ["*"]

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: "my-repo/my-image"
          tags: |
            type=ref,event=branch,suffix=-{{ sha }}
            type=ref,event=pr,suffix=-{{ sha }}

[LMS007]

I also have this issue. I think its because the workflow in my case is triggered from the merged PR and then an auto commit and tag is performed after that. So the SHA then points to the second to the last commit which is what triggered the workflow, but the SHA does not match the tag.

[scalp42]

what @evandam said, it’d be great if we could fetch the “real” SHA of the PR vs some temporary SHA that doesn’t really match to anything 😅