For pull_request_target tasks, use the pull request head SHA from the event payload as the default checkout ref so actions/checkout resolves the submitted PR content instead of the base branch tip.
Fixes: https://gitea.com/gitea/runner/issues/563
Co-Authored-By: GPT-5 Codex <codex@openai.com>