fix: Example pull_request_target: is wrong and very badly broken

[vorburger]

see www-learn-study/saraswati.learn.study#47

If you use pull_request_target: instead of pull_request: then the actions/checkout, at least in its current v4.1.1, will always check out the default branch, not the pull request; see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

[EndBug]

Hi, I see that you're not checking out the repo as in the example: if you don't provide the ref I'm using in the example, actions/checkout will check out the default branch.

Ref I'm using:

pages-preview/dependents/source_repo.yml

Line 42 in 3704427

ref: refs/pull/${{ github.event.pull_request.number }}/merge

Your step:
https://github.com/www-learn-study/saraswati.learn.study/blob/eee50b03e235fe3b4746008e1a656d0a33ddb1bb/.github/workflows/preview.yaml#L28-L31

Be careful with using these kinds of workflows with pull_request: is the workflow is changed in the PR, the author may be able to run something you don't expect