ci/pr-merged: explicitly checkout base_ref

This _should_ be the default, but actions/checkout is still complaining about checking out untrusted PR code. Technically, this workflow only runs on `merged` PRs, so the PR code _is_ trusted anyway. But currently there's no need to use the PR's code.
2026-08-24 10:14:03 -05:00 · 2026-07-01 13:42:15 +00:00
parent 266d5c31d5
commit be307b6b8f
1 changed files with 1 additions and 0 deletions
@@ -77,6 +77,7 @@ jobs:
        id: checkout
        uses: actions/checkout@v7
        with:
+          ref: ${{ github.base_ref }}
          sparse-checkout: |
            flake/dev/diff-plugins.py
            flake.lock