Checkout v7 still treats the pull_request_target default ref as fork PR code, so pin the backport checkout to the trusted base SHA.
Checkout v7 still treats the pull_request_target default ref as fork PR code, so pin the backport checkout to the trusted base SHA.