Commit 14d85a2feaa for woocommerce

commit 14d85a2feaafbbc376ebd4b9e9efe3e24275bb51
Author: Eason <eason.su.tw@gmail.com>
Date:   Wed Jul 15 18:06:56 2026 +0800

    Fix auto-milestone assignment for fork PRs after actions/checkout v7 bump (#66619)

    ci: fix auto-milestone assignment for fork PRs after checkout v7 bump

    The "Auto-assign milestone on merge" workflow checks out the repo to run
    its assignment script. Bumping actions/checkout from v4 to v7 introduced
    a "pwn request" guard that refuses to check out fork PR code in a
    pull_request_target workflow. With no ref, checkout defaults its commit
    to github.sha, which for a merged fork PR is the merge commit the guard
    rejects, so the Checkout step failed before the script ran. Community
    (fork) PRs merged to trunk silently stopped receiving their milestone.

    Pin the checkout to the PR's base branch so it runs trunk's trusted
    scripts and clears the guard, without opting into allow-unsafe-pr-checkout.

diff --git a/.github/workflows/pr-auto-milestone-on-merge.yml b/.github/workflows/pr-auto-milestone-on-merge.yml
index bd0161a4777..a9c546a2cc2 100644
--- a/.github/workflows/pr-auto-milestone-on-merge.yml
+++ b/.github/workflows/pr-auto-milestone-on-merge.yml
@@ -18,6 +18,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          # Fork PRs need this. Without it, under pull_request_target checkout defaults its commit
+          # to github.sha, which for a merged fork PR is the merge commit that actions/checkout
+          # refuses to check out due to its "pwn request" guard.
+          ref: ${{ github.event.pull_request.base.ref }}
           sparse-checkout: |
             .github/workflows/scripts