master builds should use the commit at the time it was merged

Jenkinsfile

@@ -144,22 +144,39 @@ def checkout_git(label) {
         cd cryptography
         git fetch origin +refs/pull/${env.CHANGE_ID}/merge:
         git checkout -qf FETCH_HEAD
-        git rev-parse HEAD
         """
+        if (label.contains("windows")) {
+            bat script
+        } else {
+            sh """#!/bin/sh
+                set -xe
+                ${script}
+            """
+        }
     } else {
-        script = """
-        git clone --depth=1 https://github.com/pyca/cryptography.git cryptography
-        cd cryptography
-        git checkout ${env.BRANCH_NAME}
-        git rev-parse HEAD
-        """
+        checkout([
+            $class: 'GitSCM',
+            branches: [[name: "*/${env.BRANCH_NAME}"]],
+            doGenerateSubmoduleConfigurations: false,
+            extensions: [[
+                $class: 'RelativeTargetDirectory',
+                relativeTargetDir: 'cryptography'
+            ]],
+            submoduleCfg: [],
+            userRemoteConfigs: [[
+                'url': 'https://github.com/pyca/cryptography'
+            ]]
+        ])
     }
     if (label.contains("windows")) {
-        bat script
+        bat """
+            cd cryptography
+            git rev-parse HEAD
+        """
     } else {
-        sh """#!/bin/sh
-        set -xe
-        ${script}
+        sh """
+            cd cryptography
+            git rev-parse HEAD
         """
     }
 }