When opening a pull request, a job titled 'Bundles - size-limit' will be executed to calculate the size increase of packages added via the package manager. I believe this is too see any changes to the compiled size introduced via a PR, yet due the nature of pull_request_target by default using the context of the base ref of the PR, it compares main with main.

Lexical version: N/A

Steps To Reproduce

1. Open a Pull Request from any branch
2. Let the 'Bundles - size-limit' workflow run
3. View the actions/checkout@v4 step to check the ref debug log to see its set to refs/head/main

Link to code example:

1. Action run of a random PR, showing main as the ref
2. PR that edits package.json, yet size-limit comment shows no size increase

The current behavior

'Bundles - size-limit' checkouts the base of the PR (most of the time main) and compares the built size with main

The expected behavior

'Bundles - size-limit' checkouts the head of the PR and compares the built size with main

Impact of fix

This happens on every pull request. Fixing involves 2 possible solutions:

1. Add the github.pull_request.head_ref as ref for the checkout action

• NOTE: This solutions means npm install & npm run build is executed on untrusted code when a PR is raised.

2. Change to pull_request event trigger, but this workflow will now require approval