for a pull_request event, this commit is the merge of the PR and the base branch, BUT NOT NECESSARILY THE SAME AS refs/pull/:prNumber/merge. If the commit is unreachable from any remote refs, there would be no way to fetch it via git-clone, so the SHA cannot be understood in local. Nevertheless, the main use of this merge commit is to find its parents, whose SHAs can alternatively be obtained by making GraphQL queries (https://docs.github.com/en/graphql).
The GITHUB_SHA environment variable, or the github.sha expression in the workflow file, gives the SHA that triggered the workflow run. According to
https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request
for a pull_request event, this commit is the merge of the PR and the base branch, BUT NOT NECESSARILY THE SAME AS refs/pull/:prNumber/merge. If the commit is unreachable from any remote refs, there would be no way to fetch it via git-clone, so the SHA cannot be understood in local. Nevertheless, the main use of this merge commit is to find its parents, whose SHAs can alternatively be obtained by making GraphQL queries (https://docs.github.com/en/graphql).