Plugin publishes check to the wrong commit when using with GitHub Pull Request Builder

[tabletenniser]

Jenkins and plugins versions report

Environment

Jenkins: 2.479.3
OS: Linux - 6.1.49-70.116.amzn2023.x86_64
Java: 17.0.13 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)
---
Parameterized-Remote-Trigger:3.2.1
ace-editor:1.1
ansicolor:1.0.5
antisamy-markup-formatter:162.v0e6ec0fcfcf6
apache-httpcomponents-client-4-api:4.5.14-208.v438351942757
asm-api:9.7.1-97.v4cc844130d97
authentication-tokens:1.119.v50285141b_7e1
aws-credentials:242.v8d05df911e3d
aws-java-sdk:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-api-gateway:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-autoscaling:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-cloudformation:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-cloudfront:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-codebuild:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-codedeploy:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-ec2:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-ecr:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-ecs:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-efs:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-elasticbeanstalk:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-elasticloadbalancingv2:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-iam:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-kinesis:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-lambda:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-logs:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-minimal:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-organizations:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-secretsmanager:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-sns:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-sqs:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk-ssm:1.12.772-474.v7f79a_2046a_fb_
aws-java-sdk2-core:2.29.34-9.v117ff2a_65538
aws-java-sdk2-ec2:2.29.34-9.v117ff2a_65538
aws-secrets-manager-credentials-provider:1.214.va_0a_d8268d068
blueocean:1.27.16
blueocean-bitbucket-pipeline:1.27.16
blueocean-commons:1.27.16
blueocean-config:1.27.16
blueocean-core-js:1.27.16
blueocean-dashboard:1.27.16
blueocean-display-url:2.4.3
blueocean-events:1.27.16
blueocean-git-pipeline:1.27.16
blueocean-github-pipeline:1.27.16
blueocean-i18n:1.27.16
blueocean-jwt:1.27.16
blueocean-personalization:1.27.16
blueocean-pipeline-api-impl:1.27.16
blueocean-pipeline-editor:1.27.16
blueocean-pipeline-scm-api:1.27.16
blueocean-rest:1.27.16
blueocean-rest-impl:1.27.16
blueocean-web:1.27.16
bootstrap5-api:5.3.3-1
bouncycastle-api:2.30.1.79-254.vfdb_814e7791e
branch-api:2.1206.vd9f35001c95c
build-name-setter:2.4.3
build-timeout:1.33
build-user-vars-plugin:182.v378b_9f14b_487
build-with-parameters:76.v9382db_f78962
buildtriggerbadge:251.vdf6ef853f3f5
caffeine-api:3.1.8-133.v17b_1ff2e0599
checks-api:2.2.1
cloudbees-bitbucket-branch-source:933.3.1
cloudbees-folder:6.976.v4dc79fb_c458d
cobertura:1.17
code-coverage-api:4.99.0
command-launcher:116.vd85919c54a_d6
commons-lang3-api:3.17.0-84.vb_b_938040b_078
commons-text-api:1.12.0-129.v99a_50df237f7
configuration-as-code:1915.vcdd0a_d0d2625
coverage:1.16.1
credentials:1405.vb_cda_74a_f8974
credentials-binding:687.v619cb_15e923f
data-tables-api:2.1.8-1
display-url-api:2.209.v582ed814ff2f
downstream-build-cache:1.7
durable-task:581.v299a_5609d767
ec2:1801.v526399543dca_
ec2-fleet:3.2.0
echarts-api:5.5.1-5
eddsa-api:0.3.0-4.v84c6f0f4969e
email-ext:1866.v14fa_6d201654
extended-read-permission:61.vf24570ff3b_e9
favorite:2.221.v19ca_666b_62f5
font-awesome-api:6.6.0-2
forensics-api:2.7.0
generic-webhook-trigger:2.2.5
ghprb:1.42.2
git:5.7.0
git-client:6.1.0
github:1.40.0
github-api:1.321-478.vc9ce627ce001
github-branch-source:1809.v088b_5f22c768
github-checks:589.v845136f916cd
github-oauth:621.v33b_4394dda_4d
gson-api:2.11.0-85.v1f4e87273c33
handy-uri-templates-2-api:2.1.8-30.v7e777411b_148
htmlpublisher:1.37
instance-identity:201.vd2a_b_5a_468a_a_6
ionicons-api:74.v93d5eb_813d5f
jackson2-api:2.17.0-379.v02de8ec9f64c
jakarta-activation-api:2.1.3-1
jakarta-mail-api:2.1.3-1
javax-activation-api:1.2.0-7
javax-mail-api:1.6.2-10
jaxb:2.3.9-1
jdk-tool:80.v8a_dee33ed6f0
jenkins-design-language:1.27.16
jjwt-api:0.11.5-112.ve82dfb_224b_a_d
job-dsl:1.90
jobConfigHistory:1294.v961a_b_707546a_
joda-time-api:2.13.0-93.v9934da_29b_a_e9
jquery3-api:3.7.1-2
json-api:20241224-119.va_dca_a_b_ea_7da_5
json-path-api:2.9.0-118.v7f23ed82a_8b_8
junit:1312.v1a_235a_b_94a_31
lockable-resources:1327.ved786b_a_197e0
mailer:489.vd4b_25144138f
mask-passwords:173.v6a_077a_291eb_5
matrix-auth:3.2.3
matrix-project:840.v812f627cb_578
metrics:4.2.21-458.vcf496cb_839e4
mina-sshd-api-common:2.14.0-138.v6341ee58e1df
mina-sshd-api-core:2.14.0-138.v6341ee58e1df
monitoring:2.4.0
node-iterator-api:55.v3b_77d4032326
okhttp-api:4.11.0-183.va_87fc7a_89810
parameterized-scheduler:277.v61a_4b_a_49a_c5c
parameterized-trigger:806.vf6fff3e28c3e
pipeline-build-step:540.vb_e8849e1a_b_d8
pipeline-graph-analysis:216.vfd8b_ece330ca_
pipeline-graph-view:401.v99b_6582132f4
pipeline-groovy-lib:745.vdf6077913de0
pipeline-input-step:508.v584c0e9a_2177
pipeline-milestone-step:119.vdfdc43fc3b_9a_
pipeline-model-api:2.2218.v56d0cda_37c72
pipeline-model-definition:2.2218.v56d0cda_37c72
pipeline-model-extensions:2.2218.v56d0cda_37c72
pipeline-rest-api:2.34
pipeline-stage-step:312.v8cd10304c27a_
pipeline-stage-tags-metadata:2.2218.v56d0cda_37c72
pipeline-stage-view:2.34
plain-credentials:183.va_de8f1dd5a_2b_
plugin-usage-plugin:4.8
plugin-util-api:5.1.0
popper2-api:2.11.6-5
postbuildscript:3.4.1-695.vf6b_0b_8053979
prism-api:1.29.0-18
prometheus:801.v98e119d8eeda_
pubsub-light:1.18
rebuild:332.va_1ee476d8f6d
resource-disposer:0.25
scm-api:698.v8e3b_c788f0a_6
script-security:1369.v9b_98a_4e95b_2d
slack:751.v2e44153c8fe1
snakeyaml-api:2.3-123.v13484c65210a_
sse-gateway:1.27
ssh-agent:376.v8933585c69d3
ssh-credentials:349.vb_8b_6b_9709f5b_
ssh-slaves:3.1021.va_cc11b_de26a_e
sshd:3.330.vc866a_8389b_58
structs:338.v848422169819
test-results-analyzer:0.4.1
throttle-concurrents:2.16
timestamper:1.28
token-macro:400.v35420b_922dcb_
trilead-api:2.147.vb_73cc728a_32e
variant:60.v7290fc0eb_b_cd
view-job-filters:392.v2c0a_4dd46909
workflow-api:1336.vee415d95c521
workflow-basic-steps:1058.vcb_fc1e3a_21a_9
workflow-cps:4007.vd705fc76a_34e
workflow-durable-task-step:1400.v7a_fd50a_091de
workflow-job:1476.v90f02a_225559
workflow-multibranch:795.ve0cb_1f45ca_9a_
workflow-scm-step:427.v4ca_6512e7df1
workflow-step-api:678.v3ee58b_469476
workflow-support:936.v9fa_77211ca_e1
ws-cleanup:0.48
yet-another-build-visualizer:1.17

What Operating System are you using (both controller, and any agents involved in the problem)?

Linux - 6.1.49-70.116.amzn2023.x86_64

Reproduction steps

We have a Jenkins job that's triggered via https://plugins.jenkins.io/ghprb/, where we configure the branch to run against to be ${ghprbActualCommit}, which should be the HEAD commit of the PR. As far as we can tell from the job log, the job is triggered against the correct HEAD commit, but the github check is published to the HEAD-1 commit, here's the system log we see, after enabling fine log for io.jenkins.plugins.checks and org.jenkinsci.plugins.ghprb:

Jan 31, 2025 6:38:14 AM INFO org.jenkinsci.plugins.ghprb.GhprbPullRequest updatePR
Pull request #36,182 was updated/initialized on <github_repo> at 1/31/25, 6:38 AM by <pr_author> (PR update)
Jan 31, 2025 6:38:14 AM FINE org.jenkinsci.plugins.ghprb.GhprbPullRequest
New commit. Sha: Head[dd54c2f08a1906da214b278c3cfd8a71b132f8d8 => c838597858a6b5c68d089ce07f9ef5eebac57dc8] Base[fbe32c9d80be87bbf6bdb645e805886b25dec022 => fbe32c9d80be87bbf6bdb645e805886b25dec022]
...
Jan 31, 2025 6:38:36 AM FINE io.jenkins.plugins.checks.github.GitHubChecksPublisher
Published check for repo: <github_repo>, sha: dd54c2f08a1906da214b278c3cfd8a71b132f8d8, job name: <job_name>, name: ci/jenkins-test, status: in_progress
...
Jan 31, 2025 6:39:12 AM FINE io.jenkins.plugins.checks.github.GitHubChecksPublisher
Published check for repo: <github_repo>, sha: dd54c2f08a1906da214b278c3cfd8a71b132f8d8, job name: <job_name>, name: ci/jenkins-test, status: completed

Here's the job log we see for the corresponding job:

06:38:24  GitHub pull request <pr_number> of commit c838597858a6b5c68d089ce07f9ef5eebac57dc8, no merge conflicts.
06:38:24  Checking out git https://github.com/<org>/<github_repo>.git into /var/jenkins_home/jobs/...
06:38:24  The recommended git tool is: git
06:38:24  using credential <github_app_credential>
06:38:24  Wiping out workspace first.
06:38:24  Cloning the remote Git repository
06:38:24  Using shallow clone with depth 1
06:38:24  Avoid fetching tags
06:38:24  Honoring refspec on initial clone
06:38:24  Cloning repository https://github.com/<org>/<github_repo>.git
06:38:24   > git init /var/jenkins_home/jobs/...
06:38:24  Fetching upstream changes from https://github.com/<org>/<github_repo>.git
06:38:24   > git --version # timeout=10
06:38:24   > git --version # 'git version 2.39.5'
06:38:24  using GIT_ASKPASS to set credentials Github app to set check status using https://plugins.jenkins.io/github-checks/
06:38:25   > git fetch --no-tags --force --progress --depth=1 -- https://github.com/<org>/<github_repo>.git +refs/pull/36182/*:refs/remotes/origin/pr/36182/* +refs/heads/master:refs/remotes/origin/master
06:38:32   > git config remote.origin.url https://github.com/<org>/<github_repo>.git
06:38:32   > git config --add remote.origin.fetch +refs/pull/36182/*:refs/remotes/origin/pr/36182/* # timeout=10
06:38:32   > git config --add remote.origin.fetch +refs/heads/master:refs/remotes/origin/master # timeout=10
06:38:32  Avoid second fetch
06:38:32   > git rev-parse c838597858a6b5c68d089ce07f9ef5eebac57dc8^{commit} # timeout=10
06:38:32  Checking out Revision c838597858a6b5c68d089ce07f9ef5eebac57dc8 (detached)
06:38:32   > git config core.sparsecheckout # timeout=10
06:38:32   > git checkout -f c838597858a6b5c68d089ce07f9ef5eebac57dc8 # timeout=10
06:38:33  Commit message: "Run no checks"
06:38:33   > git rev-list --no-walk dd54c2f08a1906da214b278c3cfd8a71b132f8d8 # timeout=10
06:38:33  First time build. Skipping changelog.
06:38:36  [GitHub Checks] GitHub check (name: ci/jenkins-test, status: in_progress) has been published.

Expected Results

Github check should be publishing to the c838597858a6b5c68d089ce07f9ef5eebac57dc8 commit

Actual Results

Github check is actually publishing to the dd54c2f08a1906da214b278c3cfd8a71b132f8d8 commit, which isn't the newest HEAD commit on the PR.

Anything else?

No response

Are you interested in contributing a fix?

No response