We recently discovered CircleCI is using the incorrect value for CIRCLE_SHA1 roughly 20% of the time in our workflow runs.
The UI showing the graph of the workflow shows the correct commit above the graph in the box showing the duration, branch, commit, author & message, however, clicking into the jobs and inspecting the output of the “checkout” step we consistently see the incorrect commit is being used in the jobs.
We verified this by checking the tags we’re assigning to our production Docker containers, and seeing containers with two, sometimes three, different commit hashes as assigned by CIRCLE_SHA1 suggesting the workflow is running multiple times for the same commit despite our main branch changing after merging each PR.
This is happening in multiple repositories within our organization and has been happening since we started using CircleCI in October 2024.
Here’s one example where the UI shows commit 1b6f040 but all the “checkout” commands are showing HEAD is now at f577b0d7 : https://app.circleci.com/pipelines/circleci/S2dVhfDCd9Sg99mpDju3cr/4rWBBDzaeDQGTZf8ZTAnsa/4942/workflows/5316523e-7a01-4daa-9840-f782dcd8fc41
Please help us understand why this might be the case as we’d like to rectify this as soon as possible if it’s an issue on our end.