fix: use gh pr checkout to handle fork PRs in license-check workflow

[Copilot]

Summary

The license-check workflow failed on fork PRs because ref: ${{ github.head_ref }} attempts to checkout a branch that only exists in the fork, not the base repo.

Why

Fork PRs like #1702 fail at checkout with "couldn't find remote ref" because actions/checkout defaults to the base repository context.

What changed

• Removed explicit ref: ${{ github.head_ref }} from checkout step
• Added gh pr checkout step to handle both fork and same-repo PRs correctly

# Before
- uses: actions/checkout@v6
  with:
    ref: ${{ github.head_ref }}

# After
- uses: actions/checkout@v6

- name: Check out PR branch
  env:
    GH_TOKEN: ${{ github.token }}
  run: gh pr checkout ${{ github.event.pull_request.number }}

MCP impact

• No tool or API changes — Workflow-only change

Security / limits

• No security or limits impact — Uses existing GITHUB_TOKEN permissions

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed — Internal workflow change

Original prompt

#1702 PR is failing CI, probably die to license check https://github.com/github/github-mcp-server/blob/main/.github/workflows/license-check.yml#L29

Can you help me establish if this is an issue that could be resolved with a better workflow setup or if this failure is specific to the way the user is working? Ideally the license check would not fail on this sort of issue and while it needs to ensure that changes are reflected correctly is the custom head ref checkout even required etc? Please check and make a PR that would fix the check after merging and if I like the change you produce I can merge it first and then verify CI passes for the incoming PR before I merge it.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR fixes the license-check workflow to properly handle pull requests from forks. The previous implementation used ref: ${{ github.head_ref }} which fails for fork PRs because github.head_ref is empty in that context. The new approach uses gh pr checkout which correctly handles both same-repository and fork PRs.

Key Changes:

• Removed problematic ref: ${{ github.head_ref }} from the checkout step
• Added new step using gh pr checkout to properly check out PR branches from any source
• Added explanatory comment documenting the purpose of the new approach

[Copilot]

The gh pr checkout command requires the GitHub CLI to be available in the runner. While ubuntu-latest runners typically have gh pre-installed, this dependency is implicit and could break if the runner image changes. Consider adding a comment documenting this requirement, or add an explicit step to ensure gh is available (e.g., using actions/github-cli-setup or verifying with gh --version).

[Copilot]

The comment on line 29 accurately describes the purpose of this step. However, it could be more specific about the scenarios this handles. Consider expanding it to:

"Check out the actual PR branch so we can push changes back if needed. This uses 'gh pr checkout' which properly handles both same-repo and fork PRs, unlike the previous 'ref: github.head_ref' approach which fails for fork PRs."

This provides better context for future maintainers about why this approach was chosen.

Suggested change

	# Check out the actual PR branch so we can push changes back if needed
	# Check out the actual PR branch so we can push changes back if needed. This uses
	# 'gh pr checkout' which properly handles both same-repo and fork PRs, unlike the
	# previous 'ref: github.head_ref' approach which fails for fork PRs.