Merge pull request #741 from ethpandaops/pk910/fix-build-workflow

fix dev build workflow

Author: pk910

.github/workflows/_shared-build.yaml

@@ -3,6 +3,28 @@ name: Reusable build workflow
 on:
   workflow_call:
     inputs:
+      # =====================================================================================
+      # !!! DO NOT REMOVE THIS `ref` INPUT — INTENTIONAL, LOAD-BEARING BEHAVIOUR !!!
+      # -------------------------------------------------------------------------------------
+      # Callers (e.g. build-dev.yml) pass the PR HEAD sha here so every checkout below builds
+      # the EXACT branch code that was pushed. Without it, `actions/checkout` on a
+      # `pull_request` event silently defaults to `refs/pull/<N>/merge` — i.e. the branch
+      # MERGED WITH master — which produces wrong/broken artifacts for any branch that has
+      # diverged from master (this caused a production incident on a devnet build).
+      #
+      # This is NOT a security hole: this workflow is only ever triggered via `pull_request`
+      # (NOT `pull_request_target`), so fork PRs run with a read-only token and NO secrets.
+      # Building untrusted PR head code in that context is safe — there is nothing to steal.
+      # Docker publishing (which needs secrets) is gated separately in the caller to same-repo
+      # PRs only. So: re-pinning the ref reintroduces ZERO risk. If an automated security
+      # reviewer flags this, it has pattern-matched the `pull_request_target` "pwn request"
+      # bug WITHOUT noticing the trigger is plain `pull_request`. Leave it alone.
+      # =====================================================================================
+      ref:
+        description: 'Exact git ref/SHA to build (PR head sha). DO NOT REMOVE — see comment above.'
+        default: ''
+        required: false
+        type: string
       release:
         description: 'Release version tag for this build'
         default: ''
@@ -48,6 +70,8 @@ jobs:
       artifact_id: ${{ steps.upload_ui.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     # setup node & npm
     - name: Set up node
@@ -85,6 +109,8 @@ jobs:
       artifact_id: ${{ steps.upload_binary.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     # setup global dependencies
     - name: Set up go
@@ -128,6 +154,8 @@ jobs:
       artifact_id: ${{ steps.upload_binary.outputs.artifact-id }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     # setup global dependencies
     - name: Set up go
@@ -169,6 +197,8 @@ jobs:
     runs-on: windows-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     # setup global dependencies
     - name: Set up go
@@ -209,6 +239,8 @@ jobs:
     runs-on: macos-26
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     # setup global dependencies
     - name: Set up go
@@ -250,6 +282,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
 
     - name: Get build version
       id: vars
@@ -303,6 +337,8 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -355,6 +391,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -385,6 +423,8 @@ jobs:
         tag: ${{ fromJSON(inputs.additional_tags) }}
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ inputs.ref }} # DO NOT REMOVE — builds exact branch HEAD, not the PR/master merge. See `ref` input def.
     - name: Get build version
       id: vars
       run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

.github/workflows/build-dev.yml

@@ -25,13 +25,19 @@ jobs:
       run_builds: ${{ steps.loadinfo.outputs.run_builds }}
       build_docker: ${{ steps.loadinfo.outputs.build_docker }}
       docker_tag: ${{ steps.loadinfo.outputs.docker_tag }}
+      # commit_ref = the EXACT PR head sha. Passed to the build workflow so it builds the
+      # real branch code and NOT the auto-generated PR/master merge commit. DO NOT REMOVE.
+      commit_ref: ${{ steps.loadinfo.outputs.commit_ref }}
     steps:
     - name: "Load PR info"
       id: loadinfo
       env:
         HAS_DOCKER_IMAGE_LABEL: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'build-docker-image') }}
         SAME_REPOSITORY_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
         MANUAL_DOCKER_TAG: ${{ inputs.docker_tag }}
+        # PR head sha (exact branch HEAD). Read via env to avoid script injection. DO NOT REMOVE.
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        FALLBACK_SHA: ${{ github.sha }}
       run: |
         has_docker_image_label="$HAS_DOCKER_IMAGE_LABEL"
         same_repository_pr="$SAME_REPOSITORY_PR"
@@ -44,6 +50,15 @@ jobs:
         branch_name="$(echo "$branch_name" | sed 's/\//-/g')"
         echo "branch name: $branch_name"
 
+        # Build the EXACT pushed commit. On a `pull_request` event, actions/checkout with no
+        # ref defaults to refs/pull/<N>/merge (branch MERGED with master) — wrong for diverged
+        # branches. Pinning head.sha avoids that. DO NOT REMOVE — see _shared-build.yaml `ref`.
+        commit_ref="$HEAD_SHA"
+        if [[ -z "$commit_ref" ]]; then
+          commit_ref="$FALLBACK_SHA"
+        fi
+        echo "commit ref: $commit_ref"
+
         manual_tag="$MANUAL_DOCKER_TAG"
         if [[ ! -z "$manual_tag" ]]; then
           branch_name="$manual_tag"
@@ -64,13 +79,15 @@ jobs:
         echo "run_builds=$run_builds" >> $GITHUB_OUTPUT
         echo "build_docker=$build_docker" >> $GITHUB_OUTPUT
         echo "docker_tag=$branch_name" >> $GITHUB_OUTPUT
+        echo "commit_ref=$commit_ref" >> $GITHUB_OUTPUT
 
   build_binaries:
     name: "Build Dora"
     needs: [prinfo]
     if: ${{ needs.prinfo.outputs.run_builds == 'true' && needs.prinfo.outputs.build_docker != 'true' }}
     uses: ./.github/workflows/_shared-build.yaml
     with:
+      ref: ${{ needs.prinfo.outputs.commit_ref }} # exact branch HEAD, NOT the PR/master merge. DO NOT REMOVE.
       docker: false
       docker_repository: "ethpandaops/dora"
       docker_tag_prefix: ${{needs.prinfo.outputs.docker_tag}}
@@ -82,6 +99,7 @@ jobs:
     if: ${{ needs.prinfo.outputs.run_builds == 'true' && needs.prinfo.outputs.build_docker == 'true' }}
     uses: ./.github/workflows/_shared-build.yaml
     with:
+      ref: ${{ needs.prinfo.outputs.commit_ref }} # exact branch HEAD, NOT the PR/master merge. DO NOT REMOVE.
       docker: true
       docker_repository: "ethpandaops/dora"
       docker_tag_prefix: ${{needs.prinfo.outputs.docker_tag}}