fix: prevent manifest update after another commit

.github/actions/argus-builder/manifest-update/action.yml

@@ -31,14 +31,29 @@ runs:
       with:
         app_id: ${{ inputs.github_app_id }}
         private_key: ${{ inputs.github_private_key }}
-    - name: Calculate Branch and Base Names
-      id: refs
-      uses: chanzuckerberg/github-actions/.github/actions/[email protected]
+    - name: Determine checkout ref
+      id: ref
+      uses: actions/github-script@v7
+      with:
+        result-encoding: string
+        script: |
+          const eventName = context.eventName;
+          if (eventName === "pull_request") {
+            // use PR head branch name if triggered by PR
+            return context.payload.pull_request.head.ref;
+          } else if (eventName === "push") {
+            // return empty string if triggered by push, this is to ensure the checkout action uses the 
+            // default behavior which will prevent race condition commits from multiple builders triggered back-to-back
+            return '';
+          } else {
+            core.setFailed(`EventName ${eventName} not supported`);
+            return;
+          }
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
         token: ${{ steps.generate_token.outputs.token }}
-        ref: ${{ steps.refs.outputs.headRef }}
+        ref: ${{ steps.ref.outputs.result }}
     - name: Parse envs
       id: parse_envs
       uses: actions/github-script@v7
@@ -78,4 +93,3 @@ runs:
       with:
         add: -A
         message: 'chore: Updated [${{ steps.parse_envs.outputs.envs }}] values.yaml image tags to ${{ inputs.image_tag }}'
-

.github/workflows/argus-docker-build.yaml

@@ -47,6 +47,7 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      pull-requests: read
     steps:
       - uses: chanzuckerberg/github-actions/.github/actions/argus-builder/build-prep@f801d1e293e6275cc1f5c0d6061ff0e3de640589
         id: build_prep
@@ -236,7 +237,7 @@ jobs:
             console.log('Argus root dirs:', argusRootDirs);
             return argusRootDirs.join(',');
 
-      - uses: chanzuckerberg/github-actions/.github/actions/argus-builder/manifest-update@f801d1e293e6275cc1f5c0d6061ff0e3de640589
+      - uses: chanzuckerberg/github-actions/.github/actions/argus-builder/manifest-update@0b9b41fa49ec6d64bacbeab699712434e79c3476
         if: steps.determine_manifests.outputs.result != ''
         with:
           envs: ${{ inputs.envs }}