Set GITHUB_SHA to correct value for PRs

[juxtin]

In re your comment here: actions/dependency-review-action#545 (comment)

This appears to be a bug in https://github.com/gradle/github-dependency-graph-gradle-plugin, which is used indirectly by this project to submit dependencies. I'll file an issue with them to get it fixed, but in the meantime I believe this PR will help.

---

Unfortunately, github.sha is not a good choice for the SHA to use when submitting a dependency snapshot for a PR. In the case of a PR, github.sha is (IIRC) a hypothetical merge commit, rather than the head SHA for the PR itself.

Since what we want is the PR's head SHA, we get that from github.event.pull_request.head.sha when that variable is available.

See https://github.com/gradle/github-dependency-graph-gradle-plugin#required-environment-variables for configuration reference for the Gradle plugin that submits dependencies.

[juxtin]

I can see this didn't work as expected, which means it'll probably need to be fixed upstream in either https://github.com/gradle/github-dependency-graph-gradle-plugin or https://github.com/gradle/gradle-build-action. I'm working on an issue and maybe a PR for them.

[hfhbd]

Maybe I found a workaround until there is a proper fix in the Gradle build action:
The Gradle build action applies an Gradle init script, which applies the Gradle GitHub decendency project plugin. This project plugin is evaluated for each Gradle invocation and uses the current GITHUB_SHA: https://github.com/gradle/github-dependency-graph-gradle-plugin/blob/main/plugin/src/main/kotlin/org/gradle/github/dependencygraph/GitHubSnapshotParams.kt#L20

As a workaround you will need to overwrite GITHUB_SHA for each invocation of Gradle, not in the setup only.