ci(backports): "Refusing to checkout from 'pull_request_target'" #40410

Problem:
The backport workflow started failing since we updated to v7 of
`actions/checkout@v7.0.0`. The workflow runs on `pull_request_target`
(closed + merged) and failed with:

    Refusing to check out fork pull request code from a 'pull_request_target'
    workflow. Review the risks at https://gh.io/securely-using-pull_request_target

Example: https://github.com/neovim/neovim/actions/runs/28161004305

Analysis:
v7.0.0 added the `allow-unsafe-pr-checkout` guard, which refuses when the
resolved checkout SHA matches the PR's head.sha *or* merge_commit_sha. With no
explicit `ref`, checkout resolves to the base branch tip (`github.sha`). For a
merged PR that tip *is* the merge commit, so the guard refuses even
though it is already-merged trusted base code, not live fork code.

Solution:
Checkout the base branch by name. A branch ref is neither a SHA nor
a `refs/pull/*` ref, so the guard passes. This is also semantically more
correct: backports should branch off the ref the PR merged into.

0 files changed, 0 insertions, 0 deletions