Fix: CI job refuse pull_request_target (#289)

Author: mstanojlovic

.github/workflows/release.yaml

@@ -1,4 +1,3 @@
-
 name: "Release Automation"
 
 on:
@@ -25,6 +24,11 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # PR is guaranteed merged (see job `if`), so this commit is on master.
+          # Checking out the merge commit avoids fetching fork PR code, which
+          # actions/checkout v7 refuses in pull_request_target workflows.
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Extract Version from PR Title
         env:
@@ -66,3 +70,4 @@ jobs:
           gh release create "$VERSION" \
             --title "$VERSION" \
             --notes-file release_notes.md
+