fix: use the SHA from git rev-parse HEAD when publishing#470
Merged
Aslemammad merged 2 commits intostackblitz-labs:mainfrom Feb 25, 2026
Conversation
elliott-with-the-longest-name-on-github
had a problem deploying
to
Staging
GitHub Actions
Failure
Aslemammad
approved these changes
Feb 25, 2026
This was referenced Feb 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #465
When publishing from the CLI, uses
git rev-parse HEADto determine which SHA to publish under. This doesn't affect the "trusted" SHA from GitHub that's used to key the storage buckets and make sure the publish can only occur during the GitHub job it's supposed to occur in. This allows workflows like ours at Svelte where we require maintainers to manually run publish workflows for changes coming from forks -- these workflows have to check out a specific SHA, and that works fine, but the resulting artifacts end up published to the SHA associated withmainbecauseworkflow_dispatchworkflow triggers start out at the tip ofmain.I do note that we're now not using the response from
/check, so it's really just an "exit early if the app isn't installed in this repository" check now, which I think would happen when we try to publish anyway. So... up to you if you want to remove that/checkcall altogether.I'm unsure if this has any "breaking change" implications for other users... I guess technically if someone was relying on the current behavior it would be confusing for them, but I can't see a situation where you'd want to publish a checked-out commit under a different SHA...
I'm obviously no expert in this codebase, so if I'm being stupid with my approach, feel free to say so and I'll go away 😆