Keep every workflow_run step on the commit that passed the one before

[adelrodriguez]

On main, test, build and release each start from the previous workflow through workflow_run. In a workflow_run run, actions/checkout defaults to github.sha, which is the latest commit on main, not the commit the previous workflow checked. If main moves between steps, or an older run is re-run, build can verify a different commit than test did, and release can publish a commit that never passed both.

• Each workflow_run job checks out github.event.workflow_run.head_sha.
• Each one runs only while that SHA is still github.sha, the tip of main. A run that passes this check has the tested commit as its own head_sha, so that SHA carries through to the next step. A stale chain ends as skipped, not success, so the next step does not start, and the newer commit releases through its own chain.

Pull request runs are unchanged: the added expressions are empty on pull_request.

Pullfrog raised this on faultier#89 and sakuga#21. This PR applies the same fix here.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed commit selection and job conditions in the test, build, and release workflows.

• Pinned checkout: Each workflow_run job checks out the source run's head_sha.
• Stale run checks: Each job requires a successful source run whose SHA matches the receiving run's github.sha. Existing Actions API records confirm that workflows with all jobs skipped have conclusion skipped, so they do not pass the next success condition.
• Pull request behavior: The test and build jobs retain their pull request path. An empty checkout ref retains the default pull request checkout.

The five existing PR checks passed. I checked the GitHub event contracts and Actions API records. I did not start a new main workflow chain.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the concurrency changes in 2aa504f, since the prior review at cee9099.

• Isolated skipped runs: Changed test, build, and release to use a separate github.run_id group for stale or unsuccessful workflow_run events.
• Preserved active-run controls: Kept successful current-SHA events and pull request checks in their previous ref-based groups. Retained cancellation in test and build, and serialization without cancellation in release.

All three changed workflows passed local actionlint validation. All five PR checks passed. I checked the expressions against GitHub's documented concurrency rules; I did not start a new main workflow chain.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}