fix: Support retrieving the head SHA from workflow_run

[polarathene]

For secure workflow as Github officially advises, a pull_request event should perform a build for untrusted code and then make that available to a workflow_run triggered workflow when secrets are needed. Such as deployment. As the 2nd workflow (workflow_run) is run from the main/production branch (eg master), it will have the wrong context.sha value.

The head commit SHA is available matching that of the pull_request event, using this will allow the action to apply it's features correctly to the intended commit on pull request, not on production branch latest commit.

---

Note: this is untested. I have not yet developed a Github Action, please test and review first.

AFAIK, assuming I got the context value correct (I am having trouble finding documentation on this), it should work correctly and only apply to workflow_run triggered workflows. I am not sure if it is always desirable to use the head SHA, but for typical pull_request event that would trigger the workflow_run, I believe it makes the most sense.

Alternatively, a user input could take priority which is more flexible?

[polarathene]

Should I add two new inputs here?

One for substitute PR number context.issue.number (inputs.targetPR()), and another for this PR getSHA() method?:

function getSHA(): string {
  return inputs.targetSHA() ?? context.payload.pull_request?.head.sha ?? context.sha
}

Open to better naming 😅

[polarathene]

Closing due age of PR and lack of activity.