From a0cf2a16208fe0861a79912ce5ff745bf59bb137 Mon Sep 17 00:00:00 2001
From: vlakoff <544424+vlakoff@users.noreply.github.com>
Date: Sat, 2 May 2026 07:55:02 +0200
Subject: [PATCH] Use github.sha instead of env.GITHUB_SHA in deploy workflow

The env context in GitHub Actions expressions only exposes variables
explicitly defined via env: keys in the workflow YAML. It does not
expose runner-injected variables such as GITHUB_SHA.

As a result, the commit parameter passed to
dawidd6/action-download-artifact was an empty string, causing the
action to silently fall back to the artifact from the latest available
commit. This happened to resolve correctly in practice, but relied on
implicit fallback behavior that is not guaranteed.

Replace with ${{ github.sha }}, which is the correct and explicit way
to reference the triggering commit SHA in an expression context.
---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a8dc8070..eb3d99ff 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -66,7 +66,7 @@ jobs:
         uses: dawidd6/action-download-artifact@v20
         with:
           workflow: oxipng.yml
-          commit: ${{ env.GITHUB_SHA }}
+          commit: ${{ github.sha }}
           name: Oxipng binary (${{ matrix.target }})
           path: target