"Verify changelog fragment" job fails for all fork PRs (checkout refuses fork head under pull_request_target)

[ibolton336]

The changelog job in .github/workflows/pr-checks.yml fails for every PR opened from a fork.

The workflow triggers on pull_request_target, and the job's actions/checkout@v4 step checks out github.event.pull_request.head.sha. actions/checkout now refuses to check out fork PR code in a pull_request_target context:

Refusing to check out fork pull request code from a 'pull_request_target' workflow... set 'allow-unsafe-pr-checkout: true'

Example failure: https://github.com/konveyor/agentic-controller/actions/runs/29768454525/job/88440535802 (PR #35).

The job never executes PR code — it only runs git diff --name-only origin/<base>...HEAD -- 'changes/unreleased/*.yaml' to verify a changelog fragment exists. So rather than setting allow-unsafe-pr-checkout: true, the safer fix is to check out the base repo and fetch the PR head as a ref that is only diffed, never checked out:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- run: git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
- run: git diff --name-only --diff-filter=AM origin/${{ github.event.pull_request.base.ref }}...pr-head -- ...

PR with this fix incoming.

🤖 Generated with Claude Code