fix: pin checkout ref to base SHA to prevent fork code execution

For pull_request_review events github.sha resolves to the PR head
commit (i.e. the fork's branch), so the default actions/checkout
would pull untrusted contributor code and the subsequent require()
call would execute the fork's copy of the bot script.

Explicitly set ref to github.event.pull_request.base.sha so the
checkout always lands on the verified base-branch code. Falls back
to github.sha for workflow_dispatch where pull_request is absent.

Signed-off-by: Mounil Kanakhara <mounilkankhara@gmail.com>

Author: Mounil2005

.github/workflows/on-review.yml

@@ -38,6 +38,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
           persist-credentials: false
 
       - name: Run Add Reviewers as Assignees