From 6fe24116ffff3a1f54e4b06f001e65c9feff4713 Mon Sep 17 00:00:00 2001
From: mstanojlovic_pure <mstanojlovic@purestorage.com>
Date: Fri, 24 Jul 2026 11:24:03 +0200
Subject: [PATCH] Fix: CI job refuse pull_request_target

---
 .github/workflows/release.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0da91b5a73..2c9bc15f13 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,4 +1,3 @@
-
 name: "Release Automation"
 
 on:
@@ -25,6 +24,11 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # PR is guaranteed merged (see job `if`), so this commit is on master.
+          # Checking out the merge commit avoids fetching fork PR code, which
+          # actions/checkout v7 refuses in pull_request_target workflows.
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Extract Version from PR Title
         env:
@@ -66,3 +70,4 @@ jobs:
           gh release create "$VERSION" \
             --title "$VERSION" \
             --notes-file release_notes.md
+