Workaround actions checkout not pulling latest version

See actions/checkout#439

.github/workflows/ci.yml

@@ -55,6 +55,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
 
       - name: Run tests
         uses: ./.github/actions/test
@@ -67,14 +69,14 @@ jobs:
     name: Report coverage
     needs: test
     runs-on: ubuntu-latest
-    env:
-      from_fork: ${{ github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name }}
+    if: ${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name }}
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.ref }}
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -93,13 +95,11 @@ jobs:
         run: poetry run coverage combine coverage-*/.coverage
 
       - name: Generate coverage report
-        if: ${{ env.from_fork != 'true' }}
         run: |
           poetry run coverage xml -i
           sed -i "s/home\/runner\/work\/rate-control\/rate-control/github\/workspace/g" coverage.xml
 
       - name: Report to SonarCloud
-        if: ${{ env.from_fork != 'true' }}
         uses: sonarsource/sonarcloud-github-action@v2
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -114,6 +114,7 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        ref: ${{ github.ref }}
 
       - name: Setup
         uses: ./.github/actions/setup
@@ -141,6 +142,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.PAT }}
+          ref: ${{ github.ref }}
 
       - name: Setup
         uses: ./.github/actions/setup