GitHub Actions is changing how we evaluate some events in order to make sure we always run workflows from known refs in your repository. Going forward the following events will use the workflow from the repository’s default branch instead of the SHA of the event.
We’ve removed support for the
If your workflow uses the
actions/checkout action you will now get the code from the default branch instead of the SHA in the event. Variables like
GITHUB_SHA will now have the default ref and SHA. This will cause your workflow to behave differently and potentially break if you rely on the specific version of the code at that SHA. The SHA for the event will still be included in the event payload if you need to access it.