From 1f2fe9d5c539a1e73ab7d3e8c5e087d2062add70 Mon Sep 17 00:00:00 2001
From: xiaozihao <674346354@qq.com>
Date: Fri, 11 Sep 2026 17:09:40 +0800
Subject: [PATCH] fix: validate stale submissions with current trusted code

---
 .github/workflows/submission-validation.yml | 5 +++--
 tests/submission-lifecycle.test.mjs         | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/submission-validation.yml b/.github/workflows/submission-validation.yml
index b752e3a..ccf5f27 100644
--- a/.github/workflows/submission-validation.yml
+++ b/.github/workflows/submission-validation.yml
@@ -20,10 +20,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: Check out the trusted base-branch validator only
+      - name: Check out the current trusted base-branch validator only
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
+          repository: ${{ github.event.pull_request.base.repo.full_name }}
+          ref: ${{ github.event.pull_request.base.ref }}
           path: trusted
           persist-credentials: false
 
diff --git a/tests/submission-lifecycle.test.mjs b/tests/submission-lifecycle.test.mjs
index b03baf9..061674b 100644
--- a/tests/submission-lifecycle.test.mjs
+++ b/tests/submission-lifecycle.test.mjs
@@ -424,7 +424,9 @@ describe("workflow configuration contract", () => {
     }
     expect(validation).toMatch(/\n  pull_request:\n/);
     expect(validation).not.toContain(": write");
-    expect(validation).toContain("ref: ${{ github.event.pull_request.base.sha }}");
+    expect(validation).toContain("repository: ${{ github.event.pull_request.base.repo.full_name }}");
+    expect(validation).toContain("ref: ${{ github.event.pull_request.base.ref }}");
+    expect(validation).not.toContain("ref: ${{ github.event.pull_request.base.sha }}");
     expect(receipt).toContain("pull-requests: write");
     expect(receipt).not.toContain("contents: write");
     expect(archive).toContain("workflow_run:");