ci: resolve contrib repo SHA once for hermetic CI

[mwimpelberg28]

Summary

Fixes #4305.

CONTRIB_REPO_SHA was independently re-derived from a branch-name expression in four places (ci.yml, misc.yml, test.yml, lint.yml), always resolving to a branch name, not a pinned commit:

CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
    contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
    contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
    'main'
  ) || 'main' }}

Since each job re-evaluates this independently, jobs in the same CI run (or a re-run hours later) could end up checking out different contrib commits if contrib's target branch moved in between — not hermetic, and a likely contributor to flakiness like #4853.

This PR resolves the contrib branch to a concrete commit SHA once, in a new resolve-contrib-sha job in ci.yml (via git ls-remote), and passes that SHA down to misc, tests, and contrib via workflow_call inputs instead of each workflow recomputing its own branch-name expression.

While in there, I also removed CORE_REPO_SHA: main from misc.yml/lint.yml/test.yml — it was declared in each workflow's env: block but never actually referenced anywhere in .github/. The one meaningful use of CORE_REPO_SHA (passed to contrib's core_contrib_test.yml reusable workflow) was already correctly pinned to github.sha, so this only removes dead code. lint.yml also never used CONTRIB_REPO_SHA at all, so that's dropped there too.

Changes

• .github/workflows/templates/ci.yml.j2: add resolve-contrib-sha job; wire its output into misc, tests, and contrib jobs via needs/with
• .github/workflows/templates/misc.yml.j2 / test.yml.j2: accept contrib-repo-sha as a workflow_call input instead of recomputing it; drop unused CORE_REPO_SHA
• .github/workflows/templates/lint.yml.j2: drop unused CORE_REPO_SHA / CONTRIB_REPO_SHA (neither is referenced anywhere in this workflow)
• .github/workflows/{ci,misc,lint,test}.yml: regenerated via tox -e generate-workflows (no manual edits)

Test plan

• tox -e generate-workflows regenerates the four .yml files with no diff beyond what the template changes produce (confirms templates and generated output stay in sync, matching the repo's own generate-workflows CI check)
• All four regenerated workflow files parse as valid YAML
• CI on this PR exercises the new resolve-contrib-sha job and downstream misc/tests/contrib jobs end-to-end

Note: this doesn't fully resolve #4853 (release-branch instrumentation mismatch) on its own — that likely needs a follow-up decision on what should happen when a release-branch PR's contrib ref doesn't have a matching instrumentation set. Left a note on that issue tracking it separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TKP2UVjDuXMFBeNLGs6QqE

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mwimpelberg28 / name: Matthew Wimpelberg (46402c3, 4a3efae, f396376, f91cdb0)

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on the author · refreshed 2026-09-17 22:24 UTC

Respond to 2 review items (e.g. link a commit, explain why not, ask a follow-up):

• Inline threads: 1, 2

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Should this be with reviewers? Comment /dashboard route:reviewers to route it to them.
• Anything wrong — including the routing? Report it with what you expected; it helps us improve the dashboard.

[emdneto]

some comments

[emdneto]

Don't we need CONTRIB_REPO_SHA in lint?

[emdneto]

I'm pretty sure we use CONTRIB_REPO_SHA in tox.ini, otherwise, CI will fail during releases.

[emdneto]

The major problem still this, where we can't pass a dynamic value for the reusable workflow

[opentelemetry-pr-dashboard]

Hi @mwimpelberg28 — just a friendly reminder that this pull request is waiting on you. The dashboard status comment has the open items and is kept current.

• Replying is enough to hand it off — answer, explain why no change is needed, or ask a follow-up. The dashboard routes it onward once nothing on the list is waiting on you.
• To hand it back for any other reason, including the dashboard getting this wrong, comment /dashboard route:reviewers.