🐛 Pin build-docker to the commit build-bundle actually bundled

_DEVELOP and _STAGING chain build-bundle.yml -> build-docker.yml,
both invoked with gh_ref as a branch name. Each reusable workflow
re-resolves that branch with its own checkout, at its own time.
build-docker's checkout happens minutes after build-bundle's, after
new commits can have landed on the branch, so it can compute a
different sha than the one build-bundle actually bundled and
uploaded to S3.

The Prepare job then requests a key that was never uploaded:

  fatal error: An error occurred (404) when calling the HeadObject
  operation: Key "penpot-sha-<newer-sha>.zip" does not exist

Expose build-bundle.yml's resolved sha as a workflow_call output and
thread it through _DEVELOP, _STAGING and _ADHOC as build-docker.yml's
new optional sha input, which pins its checkout instead of
re-resolving gh_ref. gh_ref keeps naming the branch tag to move.

_TAG is unaffected: it builds from a pushed git tag, which cannot
move the way a branch can, so build-bundle and build-docker already
agree on one commit there.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

.github/workflows/build-adhoc.yml

@@ -34,6 +34,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: ${{ inputs.gh_ref }}
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve gh_ref on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled if gh_ref names a branch that moved meanwhile.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force }}
 
   build-docker-admin-console:

.github/workflows/build-bundle.yml

@@ -26,6 +26,15 @@ on:
         type: boolean
         required: false
         default: false
+    outputs:
+      sha:
+        description: >-
+          The exact commit this run resolved gh_ref to and bundled. Callers
+          that also trigger build-docker.yml should pass it through as that
+          workflow's `sha` input, so both pipelines agree on one commit
+          instead of each re-resolving gh_ref independently at a different
+          time.
+        value: ${{ jobs.check.outputs.sha }}
 
 # Literal group name: under `workflow_call`, `github.workflow` resolves to the
 # caller's workflow, which put this workflow and the other reusable one called

.github/workflows/build-develop.yml

@@ -32,6 +32,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: "develop"
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve "develop" on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force || false }}
 
   build-docker-admin-console:

.github/workflows/build-docker.yml

@@ -20,6 +20,17 @@ on:
         type: string
         required: true
         default: 'develop'
+      sha:
+        description: >-
+          Exact commit to check out and build, e.g. from build-bundle.yml's
+          `sha` output. gh_ref is still used to resolve the checkout when
+          this is empty, and always names the branch tag to move — passing
+          both avoids the checkout re-resolving gh_ref on its own, possibly
+          to a newer commit than the one build-bundle.yml already bundled
+          and uploaded to S3 under its own resolved sha.
+        type: string
+        required: false
+        default: ''
       force:
         description: 'Rebuild and overwrite even if this sha is already promoted'
         type: boolean
@@ -60,7 +71,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ inputs.gh_ref }}
+          ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
       - name: Extract some useful variables
         id: vars
@@ -148,7 +159,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.gh_ref }}
+          ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@v4

.github/workflows/build-staging.yml

@@ -32,6 +32,11 @@ jobs:
     secrets: inherit
     with:
       gh_ref: "staging"
+      # Pin the exact commit build-bundle already resolved and uploaded to
+      # S3, instead of letting build-docker re-resolve "staging" on its own
+      # checkout minutes later, which can land on a newer commit than the
+      # one actually bundled.
+      sha: ${{ needs.build-bundle.outputs.sha }}
       force: ${{ inputs.force || false }}
 
   build-docker-admin-console: