CI: fix commit SHA in PR context (#18338)

.github/workflows/ci.yml

@@ -11,6 +11,12 @@ jobs:
       attestations: write # to upload assets attestation for build provenance
       id-token: write # grant additional permission to attestation action to mint the OIDC token permission
 
+    env:
+      # Commit SHA: use PR head if in a PR, otherwise fall back to github.sha
+      COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      # PR ID: set to number if in PR, otherwise blank
+      PULL_REQUEST_ID: ${{ github.event.number || '' }}
+
     steps:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
@@ -26,10 +32,6 @@ jobs:
         node-version: 'lts/*'
         cache: 'npm'
 
-    - name: Set up PR environment
-      if: github.event.number != null
-      run: echo "PULL_REQUEST_ID=${{ github.event.number }}" >> $GITHUB_ENV
-
     - name: Install npm dependencies
       run: npm ci
 

scripts/send-to-bot.py

@@ -87,7 +87,7 @@ if __name__ == "__main__":
     REPO_SLUG = os.environ.get("GITHUB_REPOSITORY")
     PR_ID = os.environ.get("PULL_REQUEST_ID")
     BUILD_ID = os.environ.get("GITHUB_RUN_ID")
-    COMMIT_SHA = os.environ.get("GITHUB_SHA")
+    COMMIT_SHA = os.environ.get("COMMIT_SHA")
 
     if PR_ID is None or BUILD_ID is None or REPO_SLUG is None or COMMIT_SHA is None:
         print("Needed environment variables are not set.", file=sys.stderr)