CI: fix inconsistent shas

.github/workflows/code-coverage-deploy.yml

@@ -1,4 +1,5 @@
 name: "Code Coverage (Deploy)"
+# see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
 
 on:
  workflow_run:
@@ -17,21 +18,37 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - uses: actions/checkout@v2
+
+ - name: Set shas
+ id: sha
+ uses: actions/github-script@v6
+ with:
+ result-encoding: string
+ script: |
+ const {data: callee_run } = await github.rest.actions.getWorkflowRun({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ run_id: context.payload.workflow_run.id,
+ });
+
+ console.log(callee_run);
+ return callee_run.head_sha;
 
+ 
  - name: Download artifact
  uses: dawidd6/action-download-artifact@v2
  with:
- name: code-coverage-${{ github.event.workflow_run.head_sha }}
+ name: code-coverage-${{ steps.sha.outputs.result }}
  workflow: code-coverage.yml
  path: ./deploy
 
  - name: Deploy to Github Pages 
  uses: JamesIves/github-pages-deploy-action@v4
  with:
  folder: ./deploy
- target-folder: "coverage/${{ github.event.workflow_run.head_sha }}"
+ target-folder: "coverage/${{ steps.sha.outputs.result }}"
  branch: gh-pages
- commit-message: "Actions: Code Coverage for ${{ github.event.workflow_run.head_sha }}"
+ commit-message: "Actions: Code Coverage for ${{ steps.sha.outputs.result }}"
 
  - name: If on main branch, copy coverage report to /latest.
  if: github.ref == 'refs/heads/main'
@@ -40,13 +57,13 @@ jobs:
  folder: ./deploy
  target-folder: "coverage/latest"
  branch: gh-pages
- commit-message: "Actions: Update latest code coverage for main (${{ github.event.workflow_run.head_sha }})"
+ commit-message: "Actions: Update latest code coverage for main (${{steps.sha.outputs.result}})"
 
  - name: Format summary
  run : |
- CONJURE_OXIDE_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ github.event.workflow_run.head_sha }}/conjure-oxide"
- MINION_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ github.event.workflow_run.head_sha }}/minion"
- CHUFFED_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ github.event.workflow_run.head_sha }}/chuffed"
+ CONJURE_OXIDE_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ steps.sha.output.result }}/conjure-oxide"
+ MINION_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ steps.sha.output.result }}/minion"
+ CHUFFED_URL="https://conjure-cp.github.io/conjure-oxide/coverage/${{ steps.sha.output.result }}/chuffed"
 
  CONJURE_OXIDE_LATEST="https://conjure-cp.github.io/conjure-oxide/coverage/latest/conjure-oxide"
  MINION_LATEST="https://conjure-cp.github.io/conjure-oxide/coverage/latest/minion"
@@ -81,9 +98,24 @@ jobs:
  ref: "gh-pages"
  path: "pages"
 
+ - name: Set shas
+ id: sha
+ uses: actions/github-script@v6
+ with:
+ result-encoding: string
+ script: |
+ const {data: callee_run } = await github.rest.actions.getWorkflowRun({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ run_id: context.payload.workflow_run.id,
+ });
+
+ console.log(callee_run);
+ return callee_run.head_sha;
+
  - name: "Generate indexes"
  run: |
- ./etc/ci/genindex.py pages/coverage/${{ github.event.workflow_run.head_sha }}
+ ./etc/ci/genindex.py pages/coverage/${{ steps.sha.outputs.result }}
  ./etc/ci/genindex.py pages/coverage/latest
  ./etc/ci/genindex.py pages/coverage/