ci: Fix workflow events (#7544)

This was found by auditing workflows based on research published here:

https://github.com/joeyparrish/workflow-cheat-sheet

The research was prompted by a workflow bug in Shaka Streamer

.github/workflows/build-and-test.yaml

@@ -19,7 +19,7 @@ on:
 # old one.  If a PR is updated and a new test run is started, the old test run
 # will be cancelled automatically to conserve resources.
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.number || inputs.ref }}
   cancel-in-progress: true
 
 jobs:

.github/workflows/demo-version-index.yaml

@@ -18,6 +18,10 @@ on:
     # Run every night at 10pm PST / 6am UTC.
     - cron: '0 6 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   appspot:
     runs-on: ubuntu-latest

.github/workflows/nightly-demo.yaml

@@ -7,6 +7,10 @@ on:
     # Run every night at midnight PST / 8am UTC.
     - cron: '0 8 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   appspot:
     runs-on: ubuntu-latest

.github/workflows/release-please.yaml

@@ -57,6 +57,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: refs/tags/${{ needs.release.outputs.tag_name }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -129,6 +130,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: refs/tags/${{ needs.release.outputs.tag_name }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -183,6 +185,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: refs/tags/${{ needs.release.outputs.tag_name }}
           fetch-depth: 0
           # Use a special shaka-bot access token for releases.
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}

.github/workflows/selenium-lab-tests.yaml

@@ -68,7 +68,7 @@ jobs:
           # If "sha" is given, it overrides PR.  If neither is given, we fall
           # back to testing "main".
           sha: ${{ inputs.sha }}
-          ref: ${{ inputs.pr && format('refs/pull/{0}/head', inputs.pr) || 'refs/heads/main' }}
+          ref: ${{ inputs.pr && format('refs/pull/{0}/merge', inputs.pr) || 'refs/heads/main' }}
 
   # Configure the build matrix based on our grid's YAML config.
   # The matrix contents will be computed by this first job and deserialized

.github/workflows/update-screenshots.yaml

@@ -23,7 +23,7 @@ jobs:
         id: compute
         uses: shaka-project/shaka-github-tools/compute-sha@main
         with:
-          ref: refs/pull/${{ inputs.pr }}/head
+          ref: refs/pull/${{ inputs.pr }}/merge
 
   set-pending-status:
     name: Set Pending Status