Contributors workflow may create PRs from main while targeting staged, causing base drift

[SriSatyaLokesh]

Summary

The contributors workflow sets PR base to staged, but checkout is not pinned to staged.
This allows manual dispatch (or default-branch execution) to run from main, create changes from main, and then open a PR against staged.

Problem

Current behavior can produce branch-base mismatch:

• PR target branch: staged
• Working branch source: whichever branch triggered the workflow (often main)

When staged has commits not present in main, this mismatch can cause conflicts, noisy diffs, or missed staged-only context.

Impact

• Higher chance of merge conflicts in bot PRs
• Incorrect or noisy contributor update diffs
• Reduced reliability of automated contributors updates

Reproduction

1. Keep repo default branch as main (or manually dispatch workflow from main).
2. Run contributors workflow.
3. Observe bot branch is created from main.
4. Observe PR is opened against staged.
5. Compare merge base and diff; branch drift appears.

Solution Plan

1. Pin checkout to staged in workflow:
   • Add ref: staged under actions/checkout.
2. Keep PR base as staged (already configured).
3. Optional safeguard:
   • Gate job to staged branch context for branch-triggered events.
4. Validate:
   • Trigger workflow manually and verify source + base are both staged.
   • Confirm PR diff contains only expected contributors/readme updates.

Acceptance Criteria

• Workflow always checks out staged before making changes.
• Generated PR branch is always based on staged.
• PR base remains staged.
• Bot PR diffs are clean and limited to contributor updates.

References

• All Contributors Bot Overview: https://allcontributors.org/en/bot/overview/
• All Contributors Bot Configuration: https://allcontributors.org/en/bot/configuration/
• All Contributors CLI Overview: https://allcontributors.org/en/cli/overview/
• All Contributors Specification: https://allcontributors.org/en/specification/
• All Contributors Emoji Key: https://allcontributors.org/en/emoji-key/

Related PR

• fix: default contributor bot PRs to staged #1256

[aaronpowell]

yeah, it's pretty broken so I just do it manually as the bot doesn't have any way to use a non-default branch either.