[Sync] Update project files from source repository (18ada86)

[mrz1836]

What Changed

• Updated the checkout ref in the auto-merge workflow from ${{ github.base_ref || github.ref }} to ${{ github.event.pull_request.base.ref }}
• Expanded security comment to clarify that pull_request_review events resolve to the PR merge ref (not head ref as previously stated)
• Added explanation that github.base_ref is only populated for pull_request/pull_request_target events, but is empty on pull_request_review events
• Updated comment to note that the base branch is now read directly from the event payload to ensure it is the trusted base ref for both trigger types

Why It Was Necessary

• The previous approach using github.base_ref || github.ref was unsafe for pull_request_review events where github.base_ref is empty and github.ref resolves to refs/pull/<n>/merge (attacker-influenced)
• This created a security vulnerability where PR-controlled code could be checked out when running privileged actions
• Reading from github.event.pull_request.base.ref ensures the checkout always uses the trusted base branch for both pull_request and pull_request_review trigger types

Testing Performed

• Verified that github.event.pull_request.base.ref correctly resolves to the base branch for both pull_request and pull_request_review events
• Confirmed the checkout now consistently uses the trusted base ref regardless of trigger type
• Validated that the workflow continues to load environment files and actions from the safe base branch

Impact / Risk

• Security improvement: Closes vulnerability where attacker-controlled code from PR merge ref could be executed with elevated permissions
• Risk: Low - change only affects which ref is checked out; behavior remains deterministic
• Breaking changes: None - workflow logic and outputs remain unchanged, only the security posture is improved

[Copilot]

Pull request overview

This PR tightens the auto-merge workflow checkout behavior so privileged workflow steps load local actions and env files from the trusted PR base branch, including on pull_request_review events.

Changes:

• Updates the sparse checkout ref from github.base_ref || github.ref to github.event.pull_request.base.ref.
• Expands the security comment to explain why pull_request_review requires reading the base ref from the event payload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.