From 2ecb26fb0259cf22362de710b7b5e7f897ed22c0 Mon Sep 17 00:00:00 2001
From: Roxy <75404941+TealSeer@users.noreply.github.com>
Date: Thu, 25 Jun 2026 20:44:03 -0400
Subject: [PATCH] Fix GBP and auto changelog workflows not working (#96667)

## About The Pull Request

The `pull_request_target` trigger by default checks out the head ref of
the PR but runs with the secrets of the base ref, which a bad actor can
take advantage of, GitHub blocks the most common vector of this by
default now. Changes the workflows to explicitly check out the base ref
(the branch being PRed to, instead of the branch being PRed) because
neither of these jobs specifically requires that it be the head ref
being checked out

## Why It's Good For The Game

Changelogs and GBP will work again

## Changelog

No
---
 .github/workflows/auto_changelog.yml | 2 ++
 .github/workflows/gbp.yml.disabled   | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/auto_changelog.yml b/.github/workflows/auto_changelog.yml
index 9b27d38e787..5e6716ad6d7 100644
--- a/.github/workflows/auto_changelog.yml
+++ b/.github/workflows/auto_changelog.yml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.base_ref }}
 
       - name: Generate App Token
         id: app-token-generation
diff --git a/.github/workflows/gbp.yml.disabled b/.github/workflows/gbp.yml.disabled
index f5b14c69cf3..603e2d69f80 100644
--- a/.github/workflows/gbp.yml.disabled
+++ b/.github/workflows/gbp.yml.disabled
@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.base_ref }}
       - name: Run Auto Labeler
         uses: actions/github-script@v9
         with:
@@ -41,6 +43,8 @@ jobs:
       - name: Checkout
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.base_ref }}
       - name: Setup git
         if: steps.value_holder.outputs.ACTIONS_ENABLED
         run: |