ci: checkout branch for pushdiff action

Signed-off-by: Paul Meyer <[email protected]>

.github/actions/pushdiff/action.yml

@@ -42,6 +42,10 @@ runs:
         (!github.event.pull_request.head.repo.fork)
       shell: bash
       run: |
+        if ! git status | grep -q "On branch"; then
+          echo "::error::pushdiff must run on a branch. Pass 'github.head_ref' as 'ref' to the checkout action."
+          exit 1
+        fi
         git config --global user.name "edgelessci"
         git config --global user.email "[email protected]"
         git commit -am "${{ inputs.renovate-commit-msg }}"

.github/workflows/static.yml

@@ -25,6 +25,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
+          token: ${{ !github.event.pull_request.head.repo.fork && secrets.NUNKI_CI_COMMIT_PUSH_PR || '' }}
       - name: Install Nix
         uses: cachix/install-nix-action@7ac1ec25491415c381d9b62f0657c7a028df52a7 # v24
         with: