ci: fix changelog checks for fork pull requests

[adonesky1]

Explanation

Summary

Resolve the pull request head commit through refs/pull/<number>/head in both changelog checks, so they work for pull requests opened from a fork.

Problem

Both changelog checks assume the pull request head branch exists in MetaMask/core. That is false for a pull request opened from a fork, so both jobs fail before running any changelog validation. This currently blocks #9875, which comes from wzrdk3lly/core.

Check Changelog passes head-ref: ${{ github.head_ref }} (a bare branch name) together with repo: ${{ github.repository }} to MetaMask/github-tools/.github/actions/check-changelog@v1. That action checks out inputs.repo at inputs.head-ref, so actions/checkout looks for a branch or tag of that name in this repository and fails:

git branch --list --remote origin/feat/phishing-controller-extract-signature-addresses
git tag --list feat/phishing-controller-extract-signature-addresses
##[error]A branch or tag with the name 'feat/phishing-controller-extract-signature-addresses' could not be found

Lint, build, and test / Validate changelog diffs resolves the head via gh api .../pulls/<n> --jq=.head.ref and then references it as origin/$PR_BRANCH. That remote-tracking ref does not exist either:

fatal: Not a valid object name origin/feat/phishing-controller-extract-signature-addresses

Solution

GitHub populates refs/pull/<number>/head in the base repository for every pull request, including forks, so it is a single ref that both checks can resolve without knowing where the head branch lives.

• changelog-check.yml: pass head-ref: refs/pull/${{ github.event.pull_request.number }}/head. actions/checkout special-cases refs/pull/ refs and fetches them into refs/remotes/pull/* instead of trying to resolve a branch or tag name (ref-helper.ts). repo stays as github.repository so that origin remains this repository and the action's own git fetch origin <base-branch> plus git diff origin/<base-branch>...HEAD still resolve.
• check-merge-queue-changelogs: fetch refs/pull/<number>/head into a local refs/remotes/pr/<number>/head ref and use it in place of origin/$PR_BRANCH. This replaces the gh api lookup, since the pull request number the action already derives is enough to name the ref.

Both checks keep working for same-repository pull requests and for merge_group events, because refs/pull/<number>/head is populated for those pull requests too.

Risk

• The new git fetch runs against a checkout created with persist-credentials: false. MetaMask/core is public, so the anonymous fetch of refs/pull/* succeeds. If this repository ever becomes private, that fetch would need credentials.
• MetaMask/metamask-mobile wires check-changelog up the same way and has the same latent problem, but it is out of scope here.

Verification

Replayed the check-merge-queue-changelogs script locally against #9875 (a fork pull request). Before the change it fails at git merge-base; after the change the ref resolves and the script proceeds to real changelog validation:

* [new ref]  refs/pull/9875/head -> pr/9875/head
resolved PR_REF -> 541dff0d9dd7d1bc164a9b2cc5b7a9100d1fc125
TARGET_REF -> fcfa4a5cf6db1adf70fb52e2b8009c61319a1596
UPDATED_CHANGELOGS -> [packages/phishing-controller/CHANGELOG.md]
Checking changelog file: packages/phishing-controller/CHANGELOG.md

References

• Unblocks feat(phishing-controller): export extractSignatureAddresses for EIP-712 typed-data scanning #9875
• Upstream action that consumes head-ref: https://github.com/MetaMask/github-tools/blob/v1/.github/actions/check-changelog/action.yml
• refs/pull/ handling in actions/checkout: https://github.com/actions/checkout/blob/v6/src/ref-helper.ts

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them