Ensure Trusted Code Checkout in GitHub Actions Workflow (#7034)

* feat: Ensure Trusted Code Checkout in GitHub Actions Workflow

* fix: update GitHub event name

.github/workflows/build.yml

@@ -68,7 +68,7 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  # Provides the Pull Request commit SHA or the GitHub merge group ref
- ref: ${{ github.event.pull_request.head.sha || github.ref }}
+ ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
  # We only need to fetch the last commit from the head_ref
  # since we're not using the `--filter` operation from turborepo
  # We don't use the `--filter` as we always want to force builds regardless of having changes or not

.github/workflows/lighthouse.yml

@@ -46,7 +46,7 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  # Provides the Pull Request commit SHA or the GitHub merge group ref
- ref: ${{ github.event.pull_request.head.sha || github.ref }}
+ ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
 
  - name: Add Comment to PR
  # Signal that a lighthouse run is about to start

.github/workflows/lint-and-tests.yml

@@ -73,7 +73,7 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  # Provides the Pull Request commit SHA or the GitHub merge group ref
- ref: ${{ github.event.pull_request.head.sha || github.ref }}
+ ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
 
  - name: Restore Lint Cache
  uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
@@ -167,7 +167,7 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  # Provides the Pull Request commit SHA or the GitHub merge group ref
- ref: ${{ github.event.pull_request.head.sha || github.ref }}
+ ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
  # The Chromatic (@chromaui/action) Action requires a full history of the current branch in order to be able to compare
  # previous changes and previous commits and determine which Storybooks should be tested against and what should be built
  fetch-depth: 0

.github/workflows/translations-pr.yml

@@ -73,7 +73,7 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  # Provides the Pull Request commit SHA or the GitHub merge group ref
- ref: ${{ github.event.pull_request.head.sha || github.ref }}
+ ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
 
  - name: Restore Lint Cache
  uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2