ci: allow checkout fork PR merge refs (#20203)

Author: smallfish

.github/workflows/cloud.yml

@@ -30,6 +30,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: "refs/pull/${{ github.event.number }}/merge"
+          allow-unsafe-pr-checkout: true
       - name: Get SHA
         shell: bash
         id: sha
@@ -62,7 +63,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: "refs/pull/${{ github.event.number }}/merge"
+          ref: ${{ needs.info.outputs.sha }}
+          allow-unsafe-pr-checkout: true
       - name: Build Release
         uses: ./.github/actions/build_linux
         timeout-minutes: 120

.github/workflows/meta.yml

@@ -28,6 +28,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: "refs/pull/${{ github.event.number }}/merge"
+          allow-unsafe-pr-checkout: true
       - name: Get SHA
         shell: bash
         id: sha
@@ -50,7 +51,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: "refs/pull/${{ github.event.number }}/merge"
+          ref: ${{ needs.info.outputs.sha }}
+          allow-unsafe-pr-checkout: true
       - name: Build Release
         uses: ./.github/actions/build_linux
         timeout-minutes: 60
@@ -70,7 +72,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: "refs/pull/${{ github.event.number }}/merge"
+          ref: ${{ needs.info.outputs.sha }}
+          allow-unsafe-pr-checkout: true
       - name: Download artifact
         uses: ./.github/actions/artifact_download
         with:

.github/workflows/reuse.benchmark.yml

@@ -63,7 +63,8 @@ jobs:
       - uses: actions/checkout@v6
         if: inputs.source == 'pr'
         with:
-          ref: "refs/pull/${{ inputs.source_id }}/merge"
+          ref: ${{ inputs.sha }}
+          allow-unsafe-pr-checkout: true
       - uses: ./.github/actions/setup_bendsql
       - uses: actions/setup-python@v6
         with:
@@ -102,7 +103,8 @@ jobs:
       - uses: actions/checkout@v6
         if: inputs.source == 'pr'
         with:
-          ref: "refs/pull/${{ inputs.source_id }}/merge"
+          ref: ${{ inputs.sha }}
+          allow-unsafe-pr-checkout: true
       - uses: ./.github/actions/setup_bendsql
       - uses: ./.github/actions/benchmark_cloud
         if: inputs.target == 'load' || inputs.target == 'all'
@@ -155,7 +157,8 @@ jobs:
       - uses: actions/checkout@v6
         if: inputs.source == 'pr'
         with:
-          ref: "refs/pull/${{ inputs.source_id }}/merge"
+          ref: ${{ inputs.sha }}
+          allow-unsafe-pr-checkout: true
       - uses: ./.github/actions/setup_bendsql
       - uses: ./.github/actions/benchmark_cloud
         if: inputs.target == 'cloud' || inputs.target == 'all'