chore: CR feedback

Author: gberenice

action.yaml

@@ -33,10 +33,15 @@ runs:
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         token: ${{ inputs.github_token }}
-        # For pull_request_target: checkout the actual PR code, not the base branch
-        ref: ${{ github.event.pull_request.head.sha || github.sha }}
-        # Support forks by using the head repository when available
-        repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+        # In pull_request_target, use the base repo's synthetic merge ref to avoid cross-repo clones
+        # and to prevent running fork code with elevated credentials. Otherwise, fall back to sha.
+        ref: ${{ (github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.number)) || github.event.pull_request.head.sha || github.sha }}
+        # Always clone from the base repository to avoid permission issues with forks
+        repository: ${{ github.repository }}
+        # Do not persist credentials into the repo's local config (reduces risk of token exfiltration)
+        persist-credentials: false
+        # Faster, smaller checkout
+        fetch-depth: 1
 
     - name: Aqua Cache
       uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3