specify the SHA when the repo running the action is unrelated

testdata/upload-download/.forgejo/workflows/test.yml

@@ -1,4 +1,4 @@
-name: Upload a Forgejo Release
+name: Upload & Download a Forgejo Release
 on: [push]
 jobs:
   setup-forgejo:
@@ -10,8 +10,10 @@ jobs:
         with:
           user: testuser
           password: admin1234
-      - run: |
-          forgejo-test-helper.sh push testrepo http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser testrepo
+      - id: testrepo
+        run: |
+          forgejo-test-helper.sh push testrepo http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser testrepo > /tmp/output
+          grep '^sha=' < /tmp/output >> $GITHUB_OUTPUT
       - id: release-upload
         uses: SELF@vTest
         with:
@@ -19,6 +21,7 @@ jobs:
           url: ${{ steps.forgejo.outputs.url }}
           repo: testuser/testrepo
           tag: v1.0
+          sha: ${{ steps.testrepo.outputs.sha }}
           doer: testuser
           token: ${{ steps.forgejo.outputs.token }}
           release-dir: upload-dir