Get reference to PR target SHA with workflow_run events

[rschristian]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Misc

Discussion Details

There's no way at the moment to get a reference to the SHA of the head of the target branch for workflow_run-triggered workflows that specifically watch for pull_request events. You can get the SHA of the PR branch head, and you can get the SHA for where the workflow is running, but that's it. No references to the branch the PR was opened against.

We need to compare SHAs on pull request, from public forks, to determine which steps in our workflows should run and currently we have to write up a separate script and query the GitHub API to get that info as it does not exist upon the event data exposed to the workflow, which is really quite frustrating as it's an obvious gap.

[jihanurrahman33]

Hi @rschristian,

You can grab the base (target) branch info in a workflow_run—it’s just not surfaced as a top-level field. For runs that originate from pull_request events, the payload includes a pull_requests array. Two reliable approaches:

---

A) Read it directly from the workflow_run payload (if present)

Many workflow_run payloads include:

• github.event.workflow_run.pull_requests[0].number
• github.event.workflow_run.pull_requests[0].base.ref
• github.event.workflow_run.pull_requests[0].head.ref
• (sometimes) github.event.workflow_run.pull_requests[0].base.sha

Example: print what the payload already gives you

jobs:
  get-base:
    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.pull_requests[0] }}
    runs-on: ubuntu-latest
    steps:
      - name: Show PR refs from payload
        run: |
          echo "PR #:        ${{ github.event.workflow_run.pull_requests[0].number }}"
          echo "Base ref:    ${{ github.event.workflow_run.pull_requests[0].base.ref }}"
          echo "Head ref:    ${{ github.event.workflow_run.pull_requests[0].head.ref }}"
          echo "Head sha:    ${{ github.event.workflow_run.head_sha }}"

If base.sha is also present in your payload, you can read it directly:

echo "Base sha:    ${{ github.event.workflow_run.pull_requests[0].base.sha }}"

---

B) Resolve the base SHA deterministically

If base.sha isn’t in your payload, use one of these:

Option B1 — Query the PR (no extra scripts, just gh)

Uses the PR number from the payload and the repo’s GITHUB_TOKEN.

jobs:
  get-base-sha:
    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.pull_requests[0] }}
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
      contents: read
    steps:
      - name: Get base sha via API
        id: base
        run: |
          PR=${{ github.event.workflow_run.pull_requests[0].number }}
          OWNER="${{ github.repository_owner }}"
          REPO="${{ github.event.repository.name }}"
          SHA=$(gh api \
            repos/$OWNER/$REPO/pulls/$PR \
            -q .base.sha)
          echo "sha=$SHA" >> $GITHUB_OUTPUT
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Use it
        run: echo "Base SHA is ${{ steps.base.outputs.sha }}"

This returns the exact base commit SHA that the PR currently targets.

Option B2 — Resolve by fetching the base ref (fast and simple)

Useful if you only need “the latest HEAD of the target branch” at run time.

jobs:
  get-base-sha:
    if: ${{ github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.pull_requests[0] }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # needed to resolve refs reliably

      - name: Resolve base sha from ref
        id: base
        run: |
          BASE_REF='${{ github.event.workflow_run.pull_requests[0].base.ref }}'
          git fetch origin "$BASE_REF" --depth=1
          SHA=$(git rev-parse FETCH_HEAD)
          echo "sha=$SHA" >> $GITHUB_OUTPUT

      - name: Use it
        run: echo "Base SHA is ${{ steps.base.outputs.sha }}"

Note: B2 gives you the current HEAD of the base branch (at job time).
If you specifically need the base SHA as of the original PR event, use B1 (API).

---

Bonus: quick compare example

Once you have both SHAs, you can gate steps:

- name: Compare range
  run: |
    BASE=${{ steps.base.outputs.sha }}
    HEAD='${{ github.event.workflow_run.head_sha }}'
    echo "Diff range: $BASE..$HEAD"
    # e.g., git log --oneline "$BASE..$HEAD" or compute changed paths

---

TL;DR:

• Check github.event.workflow_run.pull_requests[0] first; it often contains base.ref and sometimes base.sha.
• If base.sha isn’t there, either query the PR with gh api (B1) or fetch the base ref and rev-parse (B2), depending on whether you need the historical base commit or just the current one.

[rschristian]

For runs that originate from pull_request events, the payload includes a pull_requests array.

I think you're unaware that the pull_requests array is always empty when the PR originates from a fork, making this approach not viable for anything other than private repos, and seeing as how all of your answers rely upon it... you see why I opened this issue.

I certainly looked through the data prior to opening this, and opened another discussion to ask specifically about why it is empty (as it's somewhat separate from the actual issue and I wanted to avoid an X/Y problem), but, as far as I can tell, there's nothing usable in the PR event data when the PR comes from a fork. No references, no SHAs, etc.

[jihanurrahman33]

jobs:
get-base-sha:
if: ${{ github.event.workflow_run.event == 'pull_request' }}
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
steps:
- name: Resolve PR base SHA (fork-safe)
id: pr
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
OWNER="${{ github.repository_owner }}"
REPO="${{ github.event.repository.name }}"
SHA="${{ github.event.workflow_run.head_sha }}"

      # Ask GitHub which PR(s) include this commit
      PR_JSON=$(gh api "repos/$OWNER/$REPO/commits/$SHA/pulls" | jq '.[0]')

      BASE_SHA=$(echo "$PR_JSON" | jq -r '.base.sha')
      BASE_REF=$(echo "$PR_JSON" | jq -r '.base.ref')
      PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')

      echo "sha=$BASE_SHA"     >> "$GITHUB_OUTPUT"
      echo "ref=$BASE_REF"     >> "$GITHUB_OUTPUT"
      echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"

  - name: Use it
    run: |
      echo "PR #${{ steps.pr.outputs.number }}"
      echo "Base ref: ${{ steps.pr.outputs.ref }}"
      echo "Base sha: ${{ steps.pr.outputs.sha }}"

[rschristian]

That API endpoint will return nothing if the commit was from a fork. You can look at the commit information (i.e., query repos/$OWNER/$REPO/commits/$SHA) but there will not be any PR data associated with it, unlike if the commit wasn't from a fork.

[jihanurrahman33]

You’re absolutely right: for PRs from forks, workflow_run.pull_requests is empty and /commits/{sha}/pulls returns nothing. The reliable workaround is to reconstruct the PR by its head (forkOwner:branch) and then read the base ref/SHA from that PR.

Here’s a drop-in job that works for workflow_run triggered by pull_request (including forks):

jobs:
  resolve-base-for-fork:
    if: ${{ github.event.workflow_run.event == 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Derive fork head and find PR
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OWNER: ${{ github.repository_owner }}
          REPO: ${{ github.event.repository.name }}
          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
          # head_repository is present even when pull_requests[] is empty
          FORK_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
        run: |
          set -euo pipefail

          # 1) Fast path: list PRs by head=forkOwner:branch
          PR_JSON=$(gh api \
            -X GET "repos/$OWNER/$REPO/pulls?state=all&head=${FORK_OWNER}:${HEAD_BRANCH}")

          PR_NUMBER=$(jq -r '.[0].number // empty' <<<"$PR_JSON")

          # 2) Fallback: use search if list returns nothing (rare edge cases)
          if [[ -z "${PR_NUMBER:-}" ]]; then
            PR_NUMBER=$(gh api -X GET 'search/issues' \
              -f q="repo:${OWNER}/${REPO} is:pr head:${FORK_OWNER}:${HEAD_BRANCH}" \
              -q '.items[0].number // empty')
          fi

          if [[ -z "${PR_NUMBER:-}" ]]; then
            echo "Could not find PR for ${FORK_OWNER}:${HEAD_BRANCH}" >&2
            exit 1
          fi

          echo "number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"

      - name: Read base ref/sha from PR
        id: base
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OWNER: ${{ github.repository_owner }}
          REPO: ${{ github.event.repository.name }}
          PR: ${{ steps.pr.outputs.number }}
        run: |
          set -euo pipefail
          PR_JSON=$(gh api "repos/$OWNER/$REPO/pulls/$PR")
          BASE_REF=$(jq -r '.base.ref' <<<"$PR_JSON")
          BASE_SHA=$(jq -r '.base.sha' <<<"$PR_JSON")  # base commit at *current* PR state
          HEAD_SHA='${{ github.event.workflow_run.head_sha }}'

          echo "ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
          echo "sha=${BASE_SHA}" >> "$GITHUB_OUTPUT"
          echo "head=${HEAD_SHA}" >> "$GITHUB_OUTPUT"

      - name: Use it
        run: |
          echo "PR #:        ${{ steps.pr.outputs.number }}"
          echo "Base ref:    ${{ steps.base.outputs.ref }}"
          echo "Base sha:    ${{ steps.base.outputs.sha }}"
          echo "Head sha:    ${{ steps.base.outputs.head }}"

Notes:

• This doesn’t rely on workflow_run.pull_requests[] at all. It uses workflow_run.head_branch and workflow_run.head_repository.owner.login to build the head selector (forkOwner:branch) and then calls:

  • GET /repos/{owner}/{repo}/pulls?head=forkOwner:branch&state=all (primary)
  • GET /search/issues?q=repo:O/R is:pr head:forkOwner:branch (fallback)

• Once we have the PR number, GET /pulls/{number} always includes base.ref and base.sha, even for fork PRs.

• base.sha here is the current base commit of the PR at job time. If you need the historical base SHA that existed at the original PR event time, you’ll have to also fetch the PR timeline and pick the base ref SHA from the relevant event or store it when the source workflow initially ran.

If you also need “latest HEAD of the target branch right now” (instead of PR’s current base commit), fetch that ref directly:

      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - name: Resolve live base head
        id: live_base
        run: |
          BASE_REF='${{ steps.base.outputs.ref }}'
          git fetch origin "$BASE_REF" --depth=1
          echo "sha=$(git rev-parse FETCH_HEAD)" >> "$GITHUB_OUTPUT"

This pattern has been solid for public-fork PRs where the built-in associations are missing.

[rschristian]

Thanks, that seems like it'll work! However, you can skip fetching data for the PR numbers as /repos/$OWNER/$REPO/pulls?state=all&head=${FORK_OWNER}:${HEAD_BRANCH} returns data including a .base obj which has the commit SHA.

One less step is all.

2. Fallback: use search if list returns nothing (rare edge cases)

Look, I'm fairly certain you're just copy/pasting my responses and tossing them into some LLM, but it'd help if you clarified what these "rare edge cases" actually were.

[PRIYAtechky]

Getting Target Branch Head SHA in workflow_run (with PRs)

• Limitation: workflow_run does not expose the target branch head SHA.
• Available SHAs:
  • PR branch head SHA
  • Workflow run commit SHA
• Solution: Use the GitHub API.

Steps:

1. Call the API:

2. GET /repos/{owner}/{repo}/pulls/{pull_number}
   

3.Extract base.sha from the response → this is the target branch head SHA.

4.Use it in your workflow to compare with the PR head SHA.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬