Checkout doesn't match GIT_SHA

[eyal0]

According to the documentation, the default behavior is for this action to checkout at $GIT_SHA. I'm observing it actually checking out the head of the branch, which can be different from $GIT_SHA when very quick commits are made.

To reproduce this, just git commit and then git push a few times quickly with commands like this:

git commit -a --allow-empty -m "quick push" && git push
git commit -a --allow-empty -m "quick push2" && git push
git commit -a --allow-empty -m "quick push3" && git push
git commit -a --allow-empty -m "quick push4" && git push
git commit -a --allow-empty -m "quick push5" && git push

And then look at the action

The action prints out the environment and includes this:

GITHUB_SHA=26b6cad8a164ee13dcafc058da78dcb662d3a6dd

But the checkout action did this:

HEAD is now at 1435ecb Merge e5efde94203199c51e590bf0eb230b5c47edbc74 into 964149cde1d0137e0de65db64e6c97c62e8fdb31

If I look at the git log:

* bf4dd17b - (HEAD -> fix_coveralls_names, eyal0/fix_coveralls_names) quick push5 (16>
* e5efde94 - quick push4 (16 minutes ago)
* da612bcf - quick push3 (16 minutes ago)
* d28cf5c1 - quick push2 (16 minutes ago)
* 4d410ab5 - quick push (16 minutes ago)

I can see that the checkout matches the commit called quick push4 even though the action says that it's testing quick push

The solution is to checkout $GIT_SHA at the end of the checkout procedure.

[ericsciple]

@eyal0 actions/checkout@v2 fixes that race condition. For PRs, the individual SHA is now fetched.