From 59ff2a17d469c68cb5c92ba0ce2209fb2605db23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Krassowski?=
 <5832902+krassowski@users.noreply.github.com>
Date: Tue, 9 Jul 2024 10:46:29 +0100
Subject: [PATCH] Update galata-update.yml

---
 .github/workflows/galata-update.yml | 39 +++++++++++++++++++++--------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/galata-update.yml b/.github/workflows/galata-update.yml
index 9e62b35369f2..2c847ef1863d 100644
--- a/.github/workflows/galata-update.yml
+++ b/.github/workflows/galata-update.yml
@@ -57,11 +57,19 @@ jobs:
 
           echo "head_sha=$head_sha" >> $GITHUB_OUTPUT
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ steps.pr.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Checkout the branch from the PR that triggered the job
+        run: gh pr checkout ${{ github.event.issue.number }}
+
+      - name: Validate the fetched branch HEAD revision
+        env:
+          EXPECTED_SHA: ${{ steps.pr.outputs.head_sha }}
+        run: |
+          actual_sha="$(git rev-parse HEAD)"
+
+          if [[ "$actual_sha" != "$EXPECTED_SHA" ]]; then
+              echo "The HEAD of the checked out branch ($actual_sha) differs from the HEAD commit available at the time when trigger comment was submitted ($EXPECTED_SHA)"
+              exit 1
+          fi
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
@@ -153,12 +161,21 @@ jobs:
 
           echo "head_sha=$head_sha" >> $GITHUB_OUTPUT
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          path: core
-          ref: ${{ steps.pr.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Checkout the branch from the PR that triggered the job
+        working-directory: core
+        run: gh pr checkout ${{ github.event.issue.number }}
+
+      - name: Validate the fetched branch HEAD revision
+        working-directory: core
+        env:
+          EXPECTED_SHA: ${{ steps.pr.outputs.head_sha }}
+        run: |
+          actual_sha="$(git rev-parse HEAD)"
+
+          if [[ "$actual_sha" != "$EXPECTED_SHA" ]]; then
+              echo "The HEAD of the checked out branch ($actual_sha) differs from the HEAD commit available at the time when trigger comment was submitted ($EXPECTED_SHA)"
+              exit 1
+          fi
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1