Checking out wrong commit?

[jwilner]

I just introduced a failing test into the main branch of a project; the failing tests (introduced in the commit triggering the build) appeared not to have run in the PR build.

When I look at the actions/checkout output, I am surprised by what I see.

Specifically, the build is running on commit 2dca06e -- however, actions/checkout appears to be merging the prior commit -- c0121d5 -- (without the tests) into the project's main branch.

Is this expected?

The project's checkout configuration is completely vanilla: https://github.com/golangci/golangci-lint/blob/master/.github/workflows/pr.yml#L46

[jwilner]

Local discussion of issue: golangci/golangci-lint#1229

[AustinShalit]

This is similar to #237

[kenorb]

Same happens when using with ad-m/github-push-action, related:

• Extra commit when commiting ad-m/github-push-action#20
• Push issue ad-m/github-push-action#44

I've described more details at #237 (comment)

[ericsciple]

@andymckay fyi

[medikoo]

This looks quite serious (allows to sneak not validated code as valid)

@ericsciple is there any specific timeline for this?

[tjanez]

Also happened for oasisprotocol/oasis-core-ledger#16:
https://github.com/oasisprotocol/oasis-core-ledger/pull/16/checks?check_run_id=902853072

[tjanez]

I was able to use the following work-around:

[... trimmed ...]
      - name: Checkout code
        uses: actions/checkout@v2
        with:
          # Check out pull request's HEAD commit instead of the merge commit to
          # work-around an issue where wrong a commit is being checked out.
          # For more details, see:
          # https://github.com/actions/checkout/issues/299.
          ref: ${{ github.event.pull_request.head.sha }}
[... trimmed ...]

[ruz]

This affects us, we found this documentation: https://developer.github.com/v3/pulls/#response-1. I searched code in this repository for mergeable and merge_commit_sha, but couldn't find anything. Feels like it's related.

[ssantichaivekin]

I'm having the same problem in this pull request run: https://github.com/ssantichaivekin/empress/runs/900765234

It seems that this can be fixed by making a commit that is up to date with the current origin/master. See ssantichaivekin/empress#184

[lethosor]

We just ran into what I think is another instance of this issue in https://github.com/DFHack/scripts/runs/910104637?check_suite_focus=true#step:4:375
This check ran on DFHack/scripts@5177a12, but ended up running on a merge between master and the previous commit on that branch (DFHack/scripts@1ec3d9b, as seen in the actions/checkout output), which produced a lot of irrelevant errors that the newer commit was intended to address. This issue repeated itself when we re-ran the check, so it appears to be reproducible in this case, but I'm not seeing an obvious reason why - the newer commit in that PR was pushed well after the checks run on the older commit failed, and we haven't seen this in other PRs. Update: we've seen this in at least two PRs so far.

About 2 minutes after re-running the check reproduced the issue, I ran this locally, which resulted in fetching a correct merge, so I'm pretty sure the issue is on the action's end:

$ git fetch origin refs/pull/159/merge
$ git show FETCH_HEAD 
commit 5be19d326c828ac38ce307eb6db068e691504a7e
Merge: ad67c79 5177a12