ci: resolve contrib repo SHA once for hermetic CI

[mwimpelberg28]

Summary

Fixes #4305.

CONTRIB_REPO_SHA was independently re-derived from a branch-name expression in four places (ci.yml, misc.yml, test.yml, lint.yml), always resolving to a branch name, not a pinned commit:

CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
    contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
    contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
    'main'
  ) || 'main' }}

Since each job re-evaluates this independently, jobs in the same CI run (or a re-run hours later) could end up checking out different contrib commits if contrib's target branch moved in between — not hermetic, and a likely contributor to flakiness like #4853.

This PR resolves the contrib branch to a concrete commit SHA once, in a new resolve-contrib-sha job in ci.yml (via git ls-remote), and passes that SHA down to misc, tests, and contrib via workflow_call inputs instead of each workflow recomputing its own branch-name expression.

While in there, I also removed CORE_REPO_SHA: main from misc.yml/lint.yml/test.yml — it was declared in each workflow's env: block but never actually referenced anywhere in .github/. The one meaningful use of CORE_REPO_SHA (passed to contrib's core_contrib_test.yml reusable workflow) was already correctly pinned to github.sha, so this only removes dead code. lint.yml also never used CONTRIB_REPO_SHA at all, so that's dropped there too.

Changes

• .github/workflows/templates/ci.yml.j2: add resolve-contrib-sha job; wire its output into misc, tests, and contrib jobs via needs/with
• .github/workflows/templates/misc.yml.j2 / test.yml.j2: accept contrib-repo-sha as a workflow_call input instead of recomputing it; drop unused CORE_REPO_SHA
• .github/workflows/templates/lint.yml.j2: drop unused CORE_REPO_SHA / CONTRIB_REPO_SHA (neither is referenced anywhere in this workflow)
• .github/workflows/{ci,misc,lint,test}.yml: regenerated via tox -e generate-workflows (no manual edits)

Test plan

• tox -e generate-workflows regenerates the four .yml files with no diff beyond what the template changes produce (confirms templates and generated output stay in sync, matching the repo's own generate-workflows CI check)
• All four regenerated workflow files parse as valid YAML
• CI on this PR exercises the new resolve-contrib-sha job and downstream misc/tests/contrib jobs end-to-end

Note: this doesn't fully resolve #4853 (release-branch instrumentation mismatch) on its own — that likely needs a follow-up decision on what should happen when a release-branch PR's contrib ref doesn't have a matching instrumentation set. Left a note on that issue tracking it separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TKP2UVjDuXMFBeNLGs6QqE

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mwimpelberg28 / name: Matthew Wimpelberg (46402c3, 4a3efae, f396376, f91cdb0)

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on the author · refreshed 2026-10-07 00:47 UTC

Resolve merge conflicts.

Respond to 2 review items (e.g. link a commit, explain why not, ask a follow-up):

• Inline threads: 1, 2

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Should this be with reviewers? Comment /dashboard route:reviewers to route it to them.
• Anything wrong — including the routing? Report it with what you expected; it helps us improve the dashboard.

[emdneto]

some comments

[emdneto]

Don't we need CONTRIB_REPO_SHA in lint?

[emdneto]

I'm pretty sure we use CONTRIB_REPO_SHA in tox.ini, otherwise, CI will fail during releases.

[emdneto]

The major problem still this, where we can't pass a dynamic value for the reusable workflow

[opentelemetry-pr-dashboard]

Hi @mwimpelberg28 — just a friendly reminder that this pull request is waiting on you. The dashboard status comment has the open items and is kept current.

• Replying is enough to hand it off — answer, explain why no change is needed, or ask a follow-up. The dashboard routes it onward once nothing on the list is waiting on you.
• To hand it back for any other reason, including the dashboard getting this wrong, comment /dashboard route:reviewers.

[github-actions]

This PR has been automatically marked as stale because it has not had any activity for 14 days. It will be closed if no further activity occurs within 14 days of this comment.
If you're still working on this, please add a comment or push new commits.