[Bug] Trusted PR policy workflows fail on stale base commits

[wey-gu]

Affected area

GitHub / code review

Installation method

Built from source (repository GitHub Actions workflows)

Lody version or commit

main at 25546394ceea5360bd8ac23ba88e84f4005415dd (2026-08-28)

Operating system

GitHub Actions ubuntu-latest; independent of contributor operating system

Agent or runtime

GitHub Actions with actions/checkout@v7 and actions/github-script@v9

What happened?

The pull_request_target checks for external PRs can fail before policy evaluation when the PR's event base commit predates the policy modules. In #68, both External PR size and PR body failed with ERR_MODULE_NOT_FOUND for .github/scripts/pr-size-policy.mjs or .github/scripts/pr-body-policy.mjs. The workflows were loaded from the current trusted main branch, but their checkout step used github.event.pull_request.base.sha, which was d758ca4e...; that commit does not contain the policy scripts. The PR body check also reports the independent, correct body-format finding when it reaches the old checker.

What did you expect?

Trusted policy workflows should load the policy scripts from a known-good trusted repository revision and produce the intended validation result for an open PR, even when the PR was opened before those scripts were added to the default branch. They must continue to avoid checking out or executing the pull request head.

How can we reproduce it?

1. Open or retain an external PR whose base commit predates .github/scripts/pr-size-policy.mjs and .github/scripts/pr-body-policy.mjs.
2. Let the pull_request_target workflows in .github/workflows/pr-size.yml and .github/workflows/pr-body.yml run after the policy files are added to the default branch.
3. Observe that the workflows checkout github.event.pull_request.base.sha and then import a policy module that is absent at that revision.
4. Observe Error [ERR_MODULE_NOT_FOUND] under the runner workspace, followed by a failed check.

How often does it happen?

Every time for an affected PR until its base revision contains the policy modules or the workflow checkout strategy is corrected.

Relevant log output

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/home/runner/work/Lody/Lody/.github/scripts/pr-size-policy.mjs'
Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/home/runner/work/Lody/Lody/.github/scripts/pr-body-policy.mjs'

Additional context

The affected example is #68. The same trusted-checkout pattern also exists in the reopened-PR path of .github/workflows/pr-body-expiry.yml. The proposed correction should use the current trusted default branch (or another explicitly trusted, available policy revision), while never checking out or executing PR head content. This issue is separate from the session export RFC in #68.

Before submitting

• I searched the existing issues and did not find a duplicate.
• This report concerns an open-source component in this repository, not a hosted service, Web or mobile app, account, or billing issue.
• This is not a security vulnerability; security reports follow the repository's security policy.
• I removed credentials, private source, conversations, prompts, personal data, and other sensitive information.
• If I plan to submit a pull request, I will wait for a Lody maintainer to explicitly agree on the scope and approach before implementation.