From 2ff190cee1f0e3dac8c1c0357c078e14ed0bfcee Mon Sep 17 00:00:00 2001
From: Strycher <strycher@gmail.com>
Date: Sun, 19 Jul 2026 21:38:32 -0400
Subject: [PATCH] fix(#322): use PR head SHA in artifact names, not the merge
 SHA

Gemini adversarial review caught a real traceability defect.

On a `pull_request` event, `github.sha` evaluates to the last merge
commit of `refs/pull/N/merge`, not the PR head commit. That merge
commit is ephemeral and is not present in branch history, so a PR
artifact named with it cannot be traced back to any real commit,
which defeats the acceptance criterion this change was written to
satisfy.

Verified against GitHub's events-that-trigger-workflows reference:
"Note that GITHUB_SHA for this event is the last merge commit of the
pull request merge branch."

Now uses `github.event.pull_request.head.sha || github.sha`, which
resolves to the PR head on pull_request events and falls back to the
push SHA on pushes to dev/main.

Part of epic #312, plan #321 (Phase 1).
---
 .github/workflows/build.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d1d5f56..58abccd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Upload APK
         uses: actions/upload-artifact@v4
         with:
-          name: offband-android-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-android-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/app/outputs/flutter-apk/app-release.apk
           if-no-files-found: error
           retention-days: 14
@@ -65,7 +65,7 @@ jobs:
       - name: Upload Linux bundle
         uses: actions/upload-artifact@v4
         with:
-          name: offband-linux-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-linux-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/linux/x64/release/bundle/
           if-no-files-found: error
           retention-days: 14
@@ -94,7 +94,7 @@ jobs:
       - name: Upload web build
         uses: actions/upload-artifact@v4
         with:
-          name: offband-web-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-web-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/web/
           if-no-files-found: error
           retention-days: 14
@@ -112,7 +112,7 @@ jobs:
       - name: Upload Windows build
         uses: actions/upload-artifact@v4
         with:
-          name: offband-windows-r${{ github.run_number }}-${{ github.sha }}
+          name: offband-windows-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
           path: build/windows/x64/runner/Release/
           if-no-files-found: error
           retention-days: 14