From 78e7d8b13ecd7f5256a5c11ce216876164099d9f Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sat, 20 Jun 2026 16:04:22 -0500
Subject: [PATCH] ci: checkout base ref for backports

Checkout v7 still treats the pull_request_target default ref as fork PR code, so pin the backport checkout to the trusted base SHA.
---
 .github/workflows/backport.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index b0a7d25bf..d465422f0 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          ref: ${{ github.event.pull_request.base.sha }}
       - name: Create backport PRs
         id: backport
         uses: korthout/backport-action@v4