Unable to use merge commit hash in the source input

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• The documentation does not mention anything about my problem
• There are no open or closed issues that are related to my problem

Description

Unable to use merge commit hash in the source input:

- uses: docker/bake-action@v5
  with:
    source: ${{ github.server_url }}/${{ github.repository }}.git#${{ github.event.pull_request.merge_commit_sha }}

This is equivalent to:

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.merge_commit_sha }}
- uses: docker/bake-action@v5

docker/bake-action@v5 cannot find the merge commit, while actions/checkout@v4 can.

This bug prevents building a Docker image based on a merge commit in a pull_request_target event.

Expected behaviour

Image is successfully built based on merge commit.

Actual behaviour

docker/bake-action@v5 cannot find the merge commit, while actions/checkout@v4 can.

Parsing raw definition
  /usr/bin/docker buildx bake https://github.com/vivodi/docker-flexget.git#569a8e0674b0f11330577cddb340fbc67871e4f2 --file ./docker-bake.hcl --file cwd:///tmp/docker-metadata-action-bake.json --set *.tags= --set *.platform=linux/amd64 --set *.output=type=registry,name=***/flexget,push-by-digest=true --print image
  #0 building with "builder-fa364b82-62ea-463a-8441-ff9792a5355a" instance using docker-container driver
  
  #1 [internal] load git source https://github.com/vivodi/docker-flexget.git#569a8e0674b0f11330577cddb340fbc67871e4f2
  #1 0.020 Initialized empty Git repository in /var/lib/buildkit/runc-overlayfs/snapshots/snapshots/1/fs/
  #1 0.024 fatal: Not a valid object name 569a8e0674b0f11330577cddb340fbc67871e4f2^{commit}
  #1 0.353 From https://github.com/vivodi/docker-flexget
  #1 0.353  * [new branch]      dependabot/docker/python-3.13-alpine -> origin/dependabot/docker/python-3.13-alpine
  #1 0.353  * [new branch]      dependabot/pip/python-levenshtein-0.26.1 -> origin/dependabot/pip/python-levenshtein-0.26.1
  #1 0.353  * [new branch]      fix-workflow -> origin/fix-workflow
  #1 0.353  * [new branch]      main         -> origin/main
  #1 0.354  * [new branch]      main2        -> origin/main2
  #1 0.354  * [new branch]      readme       -> origin/readme
  #1 0.362 fatal: unable to read tree (569a8e0674b0f11330577cddb340fbc67871e4f2)
  #1 ERROR: failed to checkout remote https://github.com/vivodi/docker-flexget.git: git stderr:
  fatal: unable to read tree (569a8e0674b0f11330577cddb340fbc67871e4f2)
  : exit status 128
  ------
   > [internal] load git source https://github.com/vivodi/docker-flexget.git#569a8e0674b0f11330577cddb340fbc67871e4f2:
  0.020 Initialized empty Git repository in /var/lib/buildkit/runc-overlayfs/snapshots/snapshots/1/fs/
  0.024 fatal: Not a valid object name 569a8e0674b0f11330577cddb340fbc67871e4f2^{commit}
  0.353 From https://github.com/vivodi/docker-flexget
  0.353  * [new branch]      dependabot/docker/python-3.13-alpine -> origin/dependabot/docker/python-3.13-alpine
  0.353  * [new branch]      dependabot/pip/python-levenshtein-0.26.1 -> origin/dependabot/pip/python-levenshtein-0.26.1
  0.353  * [new branch]      fix-workflow -> origin/fix-workflow
  0.353  * [new branch]      main         -> origin/main
  0.354  * [new branch]      main2        -> origin/main2
  0.354  * [new branch]      readme       -> origin/readme
  0.362 fatal: unable to read tree (569a8e0674b0f11330577cddb340fbc67871e4f2)
  ------
  ERROR: failed to solve: failed to checkout remote https://github.com/vivodi/docker-flexget.git: git stderr:
  fatal: unable to read tree (569a8e0674b0f11330577cddb340fbc67871e4f2)
  : exit status 128
Error: cannot parse bake definitions: : exit status 128

Repository URL

No response

Workflow run URL

No response

YAML workflow

- uses: docker/bake-action@v5
  with:
    source: ${{ github.server_url }}/${{ github.repository }}.git#${{ github.event.pull_request.merge_commit_sha }}

Workflow logs

No response

BuildKit logs

No response

Additional info

No response

Start with the bake-action v5 source handling for the source input and the BuildKit Git source behavior shown in the logs. Reproduce the workflow using github.event.pull_request.merge_commit_sha and compare it with actions/checkout@v4; done means a merge commit can be used as the source and the image builds successfully.