Fix check-merge workflow on PRs from forks

[bluwy]

Changes

Noticed that the check-marge workflow was failing for #10189. As noted in the GH docs, GITHUB_TOKEN has a hard permission limit for PRs from forks. The way to elevate the permissions and "trust" this PR is to use the pull_request_target event.

However, when using that event, actions/checkout will only operate on the base branch of the PR. I needed to update actions/checkout to checkout the head of the PR instead to fix this. This means we can "trust" the code coming from the PR with the elevated GITHUB_TOKEN permissions, but the workflow isn't executing code from the PR so this is safe. tj-actions/changed-files also have a helpful note about it.

Testing

Should work

Docs

n/a

[changeset-bot]

⚠️ No Changeset found

Latest commit: cbcac07

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR