[ghactions] Use the Workflow's head SHA only for PRs (#4555)

We should just trust the report in all other cases; it should be
correct in general.

Author: gsnedders

api/ghactions/notify.go

@@ -146,14 +146,19 @@ func processBuild(
 		opts.Page = resp.NextPage
 	}
 
+	var sha string
+	if *workflowRun.Event == "pull_request" {
+		sha = *workflowRun.HeadSHA
+	}
+
 	uploader, err := aeAPI.GetUploader(uploaderName)
 	if err != nil {
 		return false, fmt.Errorf("failed to get uploader creds from Datastore: %w", err)
 	}
 
 	uploadClient := uc.NewClient(aeAPI)
 	err = uploadClient.CreateRun(
-		*workflowRun.HeadSHA,
+		sha,
 		uploader.Username,
 		uploader.Password,
 		nil,