Incorrect commit sha used when published from another branch

[AriPerkkio]

When Github workflow doesn't originally run on the PR branch and manual checkout to new branch is done, pkg.pr.new uses wrong commit hash in the package name.

For example when creating a workflow that publishes packages when given keyword is commented, we'll need to checkout manually to a branch. The issue_comment doesn't do that automatically:

• Any way to checkout PR from issue_comment event? actions/checkout#331 (comment)

# Run when new comment is created
on:
  issue_comment:
    types: [created]

...


# Checkout to the PR branch
- uses: actions/checkout@v4
  with:
    ref: refs/pull/${{ github.event.issue.number }}/head

# Publish
- name: Publish to pkg.pr.new
  run: >
    pnpm dlx pkg-pr-new@0.0 publish --compact --pnpm
    ./packages/eslint-remote-tester
    ./packages/repositories
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

This works well, but pkg.pr.new is picking the commit sha for package name from default branch, instead of the branch that was checkout to. Here's example: AriPerkkio/eslint-remote-tester#552

Publis script ran on https://github.com/AriPerkkio/eslint-remote-tester/actions/runs/10561403104/job/29257063251

⚡️ Your npm packages are published.
eslint-remote-tester: npm i https://pkg.pr.new/eslint-remote-tester@0f4f5aa
eslint-remote-tester-repositories: npm i https://pkg.pr.new/eslint-remote-tester-repositories@0f4f5aa

0f4f5aa is latest on master, it should have been 0c6aab0. However contents are correct:

$ pnpm i https://pkg.pr.new/eslint-remote-tester@0f4f5aa
$ cat node_modules/eslint-remote-tester/dist/index.js | grep console
    console.log('Testing');

Example workflows where this happens:

• https://github.com/AriPerkkio/eslint-remote-tester/blob/0f4f5aa0bf13a1d53a463ef0e6482fc8d62e3785/.github/workflows/publish-commit.yaml
• https://github.com/stackblitz/tutorialkit/blob/db8f238ccaf6af007ea71a4725f3d18dfeff419e/.github/workflows/publish-commit.yaml

[Aslemammad]

Let's close this for now! As discussed in #187