Pin Nova job checkouts to the triggering commit, not the branch tip

The job templates passed `ref: ${{ inputs.ref || github.ref }}` to
checkout. A non-empty ref suppresses checkout's own `commit = github.sha`
defaulting, so the fetch refspec resolved to whatever the ref pointed at
when the runner got to the checkout step -- not what triggered the run.
Commits landing during queue time were silently picked up and the results
attributed to the older SHA.

Leaving `ref` empty lets checkout default to github.ref *and* github.sha,
which pins the tree to the event SHA while still checking out a named
branch (passing github.sha directly would detach HEAD and break nightly
versioning).

test-infra-ref is deliberately unchanged.

Author: huydhn

.github/workflows/linux_job_v2.yml

@@ -60,7 +60,7 @@ on:
         default: ""
         type: string
       ref:
-        description: 'Reference to checkout, defaults to "nightly"'
+        description: 'Reference to checkout, defaults to the commit that triggered the workflow (github.sha)'
         default: ""
         type: string
       test-infra-repository:
@@ -199,7 +199,10 @@ jobs:
         with:
           # Support the use case where we need to checkout someone's fork
           repository: ${{ inputs.repository || github.repository }}
-          ref: ${{ inputs.ref || github.ref }}
+          # Leave this empty when the caller doesn't pin a ref. Checkout then
+          # defaults to github.ref *and* github.sha, so the job can't drift onto
+          # commits that landed after the run was triggered
+          ref: ${{ inputs.ref }}
           single-branch: ${{ inputs.single-branch }}
           additional-fetch-refs: ${{ inputs.additional-fetch-refs }}
           path: ${{ inputs.repository || github.repository }}

.github/workflows/linux_job_v3.yml

@@ -61,7 +61,7 @@ on:
         default: ""
         type: string
       ref:
-        description: 'Reference to checkout, defaults to "nightly"'
+        description: 'Reference to checkout, defaults to the commit that triggered the workflow (github.sha)'
         default: ""
         type: string
       test-infra-repository:
@@ -183,7 +183,10 @@ jobs:
         with:
           # Support the use case where we need to checkout someone's fork
           repository: ${{ inputs.repository || github.repository }}
-          ref: ${{ inputs.ref || github.ref }}
+          # Leave this empty when the caller doesn't pin a ref. Checkout then
+          # defaults to github.ref *and* github.sha, so the job can't drift onto
+          # commits that landed after the run was triggered
+          ref: ${{ inputs.ref }}
           single-branch: ${{ inputs.single-branch }}
           additional-fetch-refs: ${{ inputs.additional-fetch-refs }}
           path: ${{ inputs.repository || github.repository }}

.github/workflows/macos_job.yml

@@ -47,7 +47,7 @@ on:
         default: ""
         type: string
       ref:
-        description: 'Reference to checkout, defaults to "nightly"'
+        description: 'Reference to checkout, defaults to the commit that triggered the workflow (github.sha)'
         default: ""
         type: string
       test-infra-repository:
@@ -126,7 +126,10 @@ jobs:
         with:
           # Support the use case where we need to checkout someone's fork
           repository: ${{ inputs.repository || github.repository }}
-          ref: ${{ inputs.ref || github.ref }}
+          # Leave this empty when the caller doesn't pin a ref. Checkout then
+          # defaults to github.ref *and* github.sha, so the job can't drift onto
+          # commits that landed after the run was triggered
+          ref: ${{ inputs.ref }}
           path: ${{ inputs.repository || github.repository }}
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: ${{ inputs.submodules }}

.github/workflows/windows_job.yml

@@ -47,7 +47,7 @@ on:
         default: ""
         type: string
       ref:
-        description: 'Reference to checkout, defaults to "nightly"'
+        description: 'Reference to checkout, defaults to the commit that triggered the workflow (github.sha)'
         default: ""
         type: string
       test-infra-repository:
@@ -118,7 +118,10 @@ jobs:
         with:
           # Support the use case where we need to checkout someone's fork
           repository: ${{ inputs.repository || github.repository }}
-          ref: ${{ inputs.ref || github.ref }}
+          # Leave this empty when the caller doesn't pin a ref. Checkout then
+          # defaults to github.ref *and* github.sha, so the job can't drift onto
+          # commits that landed after the run was triggered
+          ref: ${{ inputs.ref }}
           path: ${{ inputs.repository || github.repository }}
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: ${{ inputs.submodules }}