Allow fork-PR checkout in pull_request_target workflows

.github/workflows/automerge-check.yml

@@ -25,6 +25,7 @@ jobs:
         with:
           fetch-depth: 2
           ref: ${{ steps.setup-refs.outputs.head_sha }}
+          allow-unsafe-pr-checkout: true
 
       - name: Get changed JSON files
         id: changed-json-files

.github/workflows/dc-template-lint.yml

@@ -24,6 +24,7 @@ jobs:
         with:
             fetch-depth: 2
             ref: ${{ steps.setup-refs.outputs.head_sha }}
+            allow-unsafe-pr-checkout: true
 
       - name: Dump GitHub context
         env:

.github/workflows/main.yml

@@ -31,6 +31,7 @@ jobs:
       with:
         fetch-depth: 2
         ref: ${{ steps.setup-refs.outputs.head_sha }}
+        allow-unsafe-pr-checkout: true
 
     - name: Get all changed files
       id: changed-all-files

.github/workflows/pr-description-check.yml

@@ -22,6 +22,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
 
       - name: Get changed template JSON files
         id: changed-templates

.github/workflows/template-labels.yml

@@ -18,6 +18,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
 
       - name: Get changed template JSON files
         id: changed-templates