specify the SHA when the repo running the action is unrelated

action.yml

@@ -12,6 +12,8 @@ inputs:
   tag:
     description: 'Tag of the release'
     required: true
+  sha:
+    description: 'SHA of the release'
   doer:
     description: 'Forgejo user authoring the upload'
   token:
@@ -40,6 +42,9 @@ runs:
         export TOKEN="${{ inputs.token }}"
         export RELEASE_DIR="${{ inputs.release-dir }}"
         export VERBOSE="${{ inputs.verbose }}"
-        export SHA="${{ github.sha }}"
+        export SHA="${{ inputs.sha }}"
+        if test -z "$SHA"; then
+          export SHA="${{ github.sha }}"
+        fi
         forgejo-release.sh ${{ inputs.direction }}
       shell: bash

testdata/upload-download/.forgejo/workflows/test.yml

@@ -1,4 +1,4 @@
-name: Upload a Forgejo Release
+name: Upload & Download a Forgejo Release
 on: [push]
 jobs:
   setup-forgejo:
@@ -10,8 +10,10 @@ jobs:
         with:
           user: testuser
           password: admin1234
-      - run: |
+      - id: testrepo
-          forgejo-test-helper.sh push testrepo http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser testrepo
+        run: |
+          forgejo-test-helper.sh push testrepo http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser testrepo > /tmp/output
+          grep '^sha=' < /tmp/output >> $GITHUB_OUTPUT
       - id: release-upload
         uses: SELF@vTest
         with:
@@ -19,6 +21,7 @@ jobs:
           url: ${{ steps.forgejo.outputs.url }}
           repo: testuser/testrepo
           tag: v1.0
+          sha: ${{ steps.testrepo.outputs.sha }}
           doer: testuser
           token: ${{ steps.forgejo.outputs.token }}
           release-dir: upload-dir