From 1ba09a026d70685ac1eca2914ca36fdfd62c3167 Mon Sep 17 00:00:00 2001
From: Kurt Garloff <kurt@garloff.de>
Date: Tue, 3 Nov 2026 08:03:13 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 6: Cache Poisoning
 via execution of untrusted code

This is what github suggests to avoid cache poisoning

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Kurt Garloff <kurt@garloff.de>
---
 .github/workflows/build.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 84a161722a..7b3f8b79dc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,5 @@
 name: Build
 on:
-  workflow_dispatch:
   pull_request:
 
 permissions:
@@ -12,7 +11,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.head_ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup Node
         uses: actions/setup-node@v6
         with: