Fix internal build for forks of org members

[ketanhwr]

Internal build stopped working a few weeks ago when Github changed their defaults for running pull_request_target workflows on forks: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/

In our case, we only checkout the code after we've verified that the fork belongs to an org member, so it should be safe.

[ask-bonk]

pull_request.user is the PR opener, not the fork owner. An org member can open a PR from an external owner's fork (for example, as a collaborator); the owner then controls the checked-out branch. With allow-unsafe-pr-checkout: true, that code runs with internal-build secrets. Authorize the head repository owner instead.

          AUTHOR: ${{ github.event.pull_request.head.repo.owner.login }}

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

PR #7243 enables trusted fork checkout for the internal build workflow.

1. [HIGH] .github/workflows/internal-build.yml:24 authorizes the PR opener instead of the fork owner, enabling an external fork owner to run code with internal-build secrets. Posted a suggestion comment.

github run

[ask-bonk]

LGTM

github run