ci(runner): build target branch campaign artifacts

.github/workflows/runner-full-stack-e2e.yml

@@ -376,6 +376,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          ref: ${{ needs.authorize.outputs.target_sha }}
           persist-credentials: false
 
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
@@ -470,6 +471,9 @@ jobs:
 
       - if: needs.catalog.outputs.needs_remote_provider_pack == 'true'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ needs.authorize.outputs.target_sha }}
+          persist-credentials: false
 
       - if: needs.catalog.outputs.needs_remote_provider_pack == 'true'
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6

tests/runner-e2e/workflow-security.test.ts

@@ -107,9 +107,9 @@ describe("public repository paid workflow security", () => {
       fullStack.match(
         /ref: \$\{\{ needs\.authorize\.outputs\.target_sha \}\}/g,
       ),
-    ).toHaveLength(3);
+    ).toHaveLength(5);
     expect(fullStack.match(/ref: \$\{\{ github\.sha \}\}/g)).toHaveLength(2);
-    expect(fullStack.match(/persist-credentials: false/g)).toHaveLength(5);
+    expect(fullStack.match(/persist-credentials: false/g)).toHaveLength(7);
     expect(fullStack).not.toContain("ref: ${{ inputs.target_branch }}");
     expect(fullStack).toContain(
       "PAPERCLIP_RUNNER_SOURCE_REVISION=${TARGET_SHA}",