workflows: Improve the change check for issue_comment triggers

[pchaigno]

Joe reported that the CI 3.0 tests were triggered in his pull request, even though it only touched test/ code and we should skip those tests in that case. The logs revealed that happened because the workflow had an incorrect view of the pull request diff (saw more changes than existed).

To retrieve the set of changed files, we instruct the paths-filter GitHub action to compare .base.sha and .head.sha. .head.sha points to the tip of the pull request branch. .base.sha however doesn't point to the last master commit of the pull request branch (the commit on which the pull request is based). Instead it points to the latest master commit at the time you trigger the workflows.

This pull request fixes this by manually retrieving the base commit via the GitHub API.

[nbusseneau]

Copying what I said on Slack regarding:

Unfortunately, there doesn't seem to be an easy way to retrieve the commit on which the pull request is based.

If you'd prefer to get the parent SHA, we already have a retrieval snippet here:

cilium/.github/workflows/lint-build-commits.yaml

Lines 57 to 62 in 41b821d

	PR_COMMITS_API_JSON=$(curl \
	-H "Accept: application/vnd.github.v3+json" \
	-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
	${{ github.event.pull_request.commits_url }})
	PR_FIRST_SHA=$(echo "$PR_COMMITS_API_JSON" | jq -r ".[0].sha")
	PR_PARENT_SHA=$(git rev-parse "${PR_FIRST_SHA}^")

No idea what approach is most useful.

[pchaigno]

Thanks @nbusseneau for the suggestion! I've taken the approach you suggested. I think it's best, at least for consistency/readability.