ci: checkout base ref for backports

Checkout v7 still treats the pull_request_target default ref as fork PR code, so pin the backport checkout to the trusted base SHA.
2026-06-20 16:06:13 -05:00
parent ee6b160bcb
commit 78e7d8b13e
1 changed files with 1 additions and 0 deletions
@@ -34,6 +34,7 @@ jobs:
      - uses: actions/checkout@v7
        with:
          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          ref: ${{ github.event.pull_request.base.sha }}
      - name: Create backport PRs
        id: backport
        uses: korthout/backport-action@v4