Update Nextstrain runtime setup step to use "modern" version [#89]

.github/workflows/pathogen-repo-ci.yaml

@@ -12,6 +12,9 @@ defaults:
     # and we don't have to refer to the docs to know the expected behavior.
     shell: bash --noprofile --norc -eo pipefail {0}
 
+permissions:
+  id-token: write
+
 on:
   workflow_call:
     inputs:
@@ -110,8 +113,17 @@ jobs:
     outputs:
       runtimes: ${{ steps.inputs.outputs.runtimes }}
 
+  workflow-context:
+    runs-on: ubuntu-latest
+    steps:
+      - id: workflow-context
+        uses: nextstrain/.github/actions/workflow-context@master
+    outputs:
+      repository: ${{ steps.workflow-context.outputs.repository }}
+      sha: ${{ steps.workflow-context.outputs.sha }}
+
   build:
-    needs: configuration
+    needs: [configuration, workflow-context]
     strategy:
       fail-fast: false
       matrix:
@@ -210,35 +222,20 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
 
-      # XXX TODO: It would be better for this to call setup-nextstrain-cli
-      # using the same ref that this workflow was called with (e.g. if this
-      # workflow was invoked by the caller workflow with @foo than we invoke
-      # the action with @foo too), but it's not currently possible to figure
-      # out that ref.  See discussion around this (including results of some
-      # investigation I did):
-      #
-      #   - https://github.community/t/reusable-workflows-get-the-ref-inside-the-called-workflow/224109
-      #   - https://github.community/t/ref-head-in-reusable-workflows/203690/92
-      #
-      # Once we can figure out that ref, then we can actions/checkout our
-      # nextstrain/.github repo at that ref as a sidecar path somewhere and
-      # then invoke the setup-nextstrain-cli action using a local file path
-      # instead of a remote owner/repo path.  This separate checkout will be
-      # necessary since the "uses:" key can't be interpolated (${{…}}) with
-      # context vars.
-      #
-      # For now, update the hardcoded ref (e.g. @90af34…) below when you make
-      # future changes to setup-nextstrain-cli.
-      #
-      # [ Update 16 Feb 2024: We solved this for pathogen-repo-build.yaml, but
-      #   because it required a new permission on the GitHub tokens (id-token:
-      #   write) we decided not to update this workflow (yet?) to use the same
-      #   approach. -trs ]
-      #
-      #   -trs, 28 April 2022
-      - name: Setup Nextstrain
-        uses: nextstrain/.github/actions/setup-nextstrain-cli@c1191de9d5e1a30e91d70b0fd1041d97ed1b2496
+      - # Need to run this after the build repo is cloned so that cloning the
+        # build repo does not overwrite the .git dir and remove the extra support files
+        # that we need from nextstrain/.github repo
+        name: Checkout ${{ needs.workflow-context.outputs.repository }} (sha ${{ needs.workflow-context.outputs.sha }})
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ needs.workflow-context.outputs.repository }}
+          ref: ${{ needs.workflow-context.outputs.sha }}
+          path: ${{ env.NEXTSTRAIN_GITHUB_DIR }}
+
+      - name: Setup Nextstrain runtime ${{ matrix.runtime }}
+        uses: ./.git/nextstrain/.github/actions/setup-nextstrain-cli
         with:
+          cli-version: ">=8.3.0"
           runtime: ${{ matrix.runtime }}
 
       - name: Run ingest