backport of commit 375c2be624 (#23419)

Co-authored-by: Hamid Ghaf <83242695+hghaf099@users.noreply.github.com>

.github/workflows/ci.yml

@@ -28,6 +28,7 @@ jobs:
       compute-xlarge: ${{ steps.setup-outputs.outputs.compute-xlarge }}
       enterprise: ${{ steps.setup-outputs.outputs.enterprise }}
       go-tags: ${{ steps.setup-outputs.outputs.go-tags }}
+      checkout-ref: ${{ steps.checkout-ref-output.outputs.checkout-ref }}
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - id: setup-outputs
@@ -59,6 +60,14 @@ jobs:
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
           no-restore: true # don't download them on a cache hit
+      # control checking out head instead of base ref by a GH label
+      # if checkout-head label is added to a PR, checkout HEAD otherwise checkout base_ref
+      - if: ${{ !contains(github.event.pull_request.labels.*.name, 'checkout-head') }}
+        run: echo "CHECKOUT_REF=${{ github.base_ref }}" >> "$GITHUB_ENV"
+      - if: ${{ contains(github.event.pull_request.labels.*.name, 'checkout-head') }}
+        run: echo "CHECKOUT_REF=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_ENV"
+      - id: checkout-ref-output
+        run: echo "checkout-ref=${{ env.CHECKOUT_REF }}" >> "$GITHUB_OUTPUT"
 
   verify-changes:
     name: Verify doc-ui only PRs
@@ -85,6 +94,7 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-large }}
       enterprise: ${{ needs.setup.outputs.enterprise }}
       test-timing-cache-key: go-test-timing-standard
+      checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
     secrets: inherit
 
   test-go-testonly:
@@ -105,6 +115,7 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-large }}
       enterprise: ${{ needs.setup.outputs.enterprise }}
       test-timing-cache-enabled: false
+      checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
     secrets: inherit
 
   test-go-race:
@@ -131,6 +142,7 @@ jobs:
       enterprise: ${{ needs.setup.outputs.enterprise }}
       name: "race"
       test-timing-cache-key: go-test-timing-race
+      checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
     secrets: inherit
 
   test-go-fips:
@@ -157,6 +169,7 @@ jobs:
       enterprise: ${{ needs.setup.outputs.enterprise }}
       name: "fips"
       test-timing-cache-key: go-test-timing-fips
+      checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
     secrets: inherit
 
   test-ui:

.github/workflows/test-go.yml

@@ -67,6 +67,11 @@ on:
         required: false
         default: go-test-reports
         type: string
+      checkout-ref:
+        description: The ref to use for checkout.
+        required: false
+        default: ${{ github.base_ref }}
+        type: string
 
 env: ${{ fromJSON(inputs.env-vars) }}
 
@@ -78,6 +83,8 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runs-on) }}
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
@@ -214,6 +221,8 @@ jobs:
       TIMEOUT_IN_MINUTES: ${{ inputs.timeout-minutes }}
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}