fix: send PR head SHA instead of OIDC merge SHA on pull_request events

[KYN4]

Summary

For pull_request and pull_request_target workflow events, GitHub's OIDC token sha claim refers to the ephemeral test-merge commit on refs/pull/{n}/merge, not the PR's actual head commit. When the action sends that merge SHA, testing-service anchors the GitHub Check Run to it — and the PR "Checks" tab fails to resolve the check, showing:

No check run found with ID <id> for this pull request

This PR resolves the real PR head SHA from GITHUB_EVENT_PATH (pull_request.head.sha) and forwards it to testing-service as a new commit_sha override field on both endpoints.

Changes

• New src/commit-sha.ts — resolvePrHeadSha(eventName) reads pull_request.head.sha from the event payload for PR events. Falls back to undefined (so the caller uses the OIDC claim) on any failure, with core.warning logging — never throws.
• src/main.ts — wires the resolver in: commitSha = prHeadSha ?? oidcSha. Logs an info message when an override is applied.
• src/api.ts — adds commitSha?: string to the triggerRun JSON body (with doc-comment about PR-only override semantics) and a commit_sha multipart field to uploadBuild.
• AGENTS.md — updates the API contract section to reflect the new override field and replaces the now-stale "never sent in the request body" note.

Server contract

The matching testing-service change (separate PR) only honours the commit_sha override when the OIDC event_name is pull_request or pull_request_target. For any other event, the override is ignored and the OIDC sha claim is used as-is — so this action remains correct on push/tag/dispatch events.

Verification

• npm run all (build + lint + format:check + bundle) passes locally
• Real-world repro: PR https://github.com/minitap-ai/minute-flow/pull/2 — Minitest check currently anchored to merge SHA 98c60bfe…, not the PR head 0a03326c…. After this PR + the testing-service fix ship, new runs on that PR will anchor to the head SHA and the check will resolve from the PR Checks tab.

Notes

• dist/ is gitignored — the release workflow rebuilds it.
• Compatible with the existing server: when sent against the unpatched testing-service, the commit_sha field is silently ignored (FastAPI accepts unknown form fields and Pydantic with extra='ignore' drops unknown JSON fields).

Summary by CodeRabbit

• New Features
  • Improved commit SHA handling for pull request events to use the actual PR head commit SHA when available, with fallback to OIDC claims for other event types.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR extends the API and action logic to support commit SHA override for pull request events. It adds optional commitSha field to the trigger run request, introduces a helper function to resolve PR head SHA from GitHub event metadata, and updates the main action to use PR head SHA when available, falling back to OIDC claims.

Changes

Cohort / File(s)	Summary
Documentation AGENTS.md	Updated API contract documentation for build-upload request to require commit_title and support optional commit_sha override. Updated run-trigger request to send commitTitle, optional commitSha, and optional PR context fields (prNumber, prTitle). Clarified commit-SHA semantics for PR events versus OIDC default behavior.
Type Definitions src/api.ts	Added optional commitSha?: string property to TriggerRunRequest type. Updated uploadBuild multipart payload to include commit_sha field alongside existing required fields.
PR Head SHA Resolution src/commit-sha.ts	New exported helper resolvePrHeadSha that reads GitHub event metadata from GITHUB_EVENT_PATH for pull_request/pull_request_target events, validates and returns PR head SHA if available, otherwise returns undefined with warning logging for fallback to OIDC claim.
Main Action Logic src/main.ts	Updated to derive prHeadSha using resolvePrHeadSha(eventName), compute final commitSha as PR head SHA with fallback to OIDC SHA, and explicitly supply commitSha to both upload and trigger run requests with override logging.

Sequence Diagram(s)

sequenceDiagram
    participant GH as GitHub Actions<br/>(pull_request event)
    participant Main as Main Action Flow
    participant CSha as Commit SHA<br/>Resolution
    participant OIDC as OIDC Token<br/>Provider
    participant API as API<br/>Server

    GH->>Main: Trigger with eventName,<br/>GITHUB_EVENT_PATH
    Main->>OIDC: Extract OIDC claims
    OIDC-->>Main: oidcSha from claims
    Main->>CSha: resolvePrHeadSha(eventName)
    CSha->>CSha: Check if PR event
    CSha->>CSha: Read GITHUB_EVENT_PATH<br/>Parse event JSON
    CSha->>CSha: Validate head.sha<br/>(40-char hex)
    CSha-->>Main: prHeadSha or undefined
    Main->>Main: Resolve final commitSha:<br/>prHeadSha || oidcSha
    Main->>API: uploadBuild(commitSha)
    API-->>Main: Success
    Main->>API: triggerRun(commitSha)
    API-->>Main: Run triggered

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• feat: forward PR and release metadata to CI run endpoint #5: Extends TriggerRunRequest payload to forward additional CI fields (prNumber, prTitle, releaseName) alongside the new commitSha handling introduced in this PR.
• feat: require and validate build inputs #3: Modifies the same API surface and upload/trigger code paths; both PRs add commit metadata forwarding through uploadBuild and triggerRun operations.
• fix: prevent binary corruption on build upload, use commit-SHA filenames #4: Updates how commit SHA is obtained and passed to uploadBuild, with overlapping changes to src/main.ts and src/api.ts for commit-SHA-driven upload behavior.

Poem

🐰 A PR hop through PR events we go,
Reading heads when the GitHub winds blow,
OIDC's our friend, but PR events shine—
Head SHA takes the override line!
Fallback graceful, the logic's divine,
Commit tracking perfect, each detail align! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix: sending PR head SHA instead of OIDC merge SHA for pull_request events, which aligns with the primary problem statement and solution in the PR objectives.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pr-head-sha-override

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

src/commit-sha.ts (1)

29-32: Clarify event name in fallback warning text.

Line 31 mentions only pull_request, but this branch also runs for pull_request_target. Consider making the message event-accurate.

Proposed tweak

-      'GITHUB_EVENT_PATH is unset on a pull_request event — falling back to OIDC sha (may not match PR head)',
+      `GITHUB_EVENT_PATH is unset on ${eventName} event — falling back to OIDC sha (may not match PR head)`,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/commit-sha.ts` around lines 29 - 32, The warning logged when eventPath is
unset (the core.warning call in src/commit-sha.ts that runs when eventPath is
falsy) is inaccurate because it only mentions "pull_request" while the branch
also applies to "pull_request_target"; update the message to be event-accurate
by reading the current event name (e.g., from process.env.GITHUB_EVENT_NAME) and
interpolating it into the warning, or explicitly mention both "pull_request" and
"pull_request_target" so the fallback message accurately reflects the events
handled.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/commit-sha.ts`:
- Around line 29-32: The warning logged when eventPath is unset (the
core.warning call in src/commit-sha.ts that runs when eventPath is falsy) is
inaccurate because it only mentions "pull_request" while the branch also applies
to "pull_request_target"; update the message to be event-accurate by reading the
current event name (e.g., from process.env.GITHUB_EVENT_NAME) and interpolating
it into the warning, or explicitly mention both "pull_request" and
"pull_request_target" so the fallback message accurately reflects the events
handled.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1275020a-1b2b-4d2d-901b-6e69390e8e81

📥 Commits

Reviewing files that changed from the base of the PR and between cce7712 and 038396d.

📒 Files selected for processing (4)

• AGENTS.md
• src/api.ts
• src/commit-sha.ts
• src/main.ts