dont use pull_request_target as it opens the repo for pwnage..

.github/workflows/tests.yml

@@ -12,8 +12,6 @@ jobs:
       options: --user root
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: '${{ github.event.pull_request.merge_commit_sha }}' # since event is pull_request_target
       - name: Install Packages
         run: yarn install --frozen-lockfile
       - name: Build