fix: make checkout expected-commit bump less greedy

docs/VAR-TRANSFORMS.md

@@ -46,6 +46,21 @@ pipeline:
       uri: https://github.com/openjdk/jdk17u/archive/refs/tags/jdk-${{vars.mangled-package-version}}.tar.gz
 ```
 
+`mangled-package-version` can also be used with `git-checkout`:
+
+```yaml
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/openjdk/jdk12u
+      tag: ${{vars.mangled-package-version}}
+      expected-commit: 5018cdd1904357c04c9c41e0f8fe8994916cb638
+```
+
+
+Note: If `melange bump` is run, it will attempt to update the `expected-commit` value.
+
+
 Other example:
 
 In some case, you need to join two or more regex match subgroups with `_`. Here you must use `${1}` instead of `$1`. More information [here](https://github.com/golang/go/issues/32885#issuecomment-507477621)

pkg/renovate/bump/bump.go

@@ -22,7 +22,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"regexp"
 	"strconv"
 	"strings"
 
@@ -225,8 +224,7 @@ func updateGitCheckout(ctx context.Context, node *yaml.Node, expectedGitSha stri
 	if err != nil {
 		log.Infof("git-checkout node does not contain a tag, assume we need to update the expected-commit sha")
 	} else {
-		versionPattern := regexp.MustCompile(`\${{vars\..+}}`)
-		if !strings.Contains(tag.Value, "${{package.version}}") && !versionPattern.MatchString(tag.Value) {
+		if !strings.Contains(tag.Value, "${{package.version}}") && !strings.Contains(tag.Value, "${{vars.mangled-package-version}}") {
 			log.Infof("Skipping git-checkout node as it does not contain a version substitution so assuming it is not the main checkout")
 			return nil
 		}
@@ -237,7 +235,7 @@ func updateGitCheckout(ctx context.Context, node *yaml.Node, expectedGitSha stri
 	if expectedGitSha != "" {
 		// Update expected hash nodes.
 		nodeCommit, err := renovate.NodeFromMapping(withNode, "expected-commit")
-		if err == nil {
+		if err == nil && !strings.Contains(nodeCommit.Value, "${{") {
 			nodeCommit.Value = expectedGitSha
 			log.Infof("  expected-commit: %s", expectedGitSha)
 		}