Run approved PR builds with PR-aware UF2 version metadata

.github/workflows/build.yml

@@ -12,6 +12,9 @@ on:
     types:
       - submitted
 
+permissions:
+  contents: read
+
 jobs:
   compile:
     if: github.event_name != 'pull_request_review' || github.event.review.state == 'approved'
@@ -22,7 +25,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.event.review.pull_request.head.sha || github.sha }}
 
       - name: Set up Arduino CLI
         uses: arduino/setup-arduino-cli@v2
@@ -46,6 +49,9 @@ jobs:
 
       - name: Resolve build version
         id: build_version
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || github.event.review.pull_request.number || '' }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.review.pull_request.head.sha || github.sha }}
         run: |
           set -eu
           SEMVER_RE='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
@@ -60,8 +66,7 @@ jobs:
           fi
 
           if [ "${{ github.event_name }}" = "pull_request" ] || [ "${{ github.event_name }}" = "pull_request_review" ]; then
-            PR_NUMBER="${{ github.event.pull_request.number }}"
-            SHORT_SHA="$(git rev-parse --short=8 "${GITHUB_SHA}")"
+            SHORT_SHA="$(git rev-parse --short=8 "${HEAD_SHA}")"
             VERSION="${BASE_VERSION}-pr${PR_NUMBER}+${SHORT_SHA}"
           else
             VERSION="${BASE_VERSION}"