fix(.github/workflows): detect PR-changed modules via the pulls files API

[bpmct]

Fixes the Module Scorecard Check commenting on modules a PR never touched, reported on #1034 where a windows-rdp PR got a scorecard comparison for coder/git-clone.

Linear: REG-74

Root cause

The workflow detected changed modules with git diff "${BASE_SHA}"...HEAD, where BASE_SHA is github.event.pull_request.base.sha and HEAD is GitHub's test merge commit (PR head merged into current main). base.sha is the base tip from when the PR was opened, so on PRs whose base has since moved, the diff includes every module merged to main after the PR branched. #1034 was opened July 29; git-clone changed on main afterwards (#1037), so a later synchronize run scored it, and score noise made it look like a regression.

Change

• Determine changed modules from GET /repos/{owner}/{repo}/pulls/{n}/files (paginated) instead of git plumbing. The PR files list is the source of truth for what a PR changes, regardless of how stale the branch is.
• Drop fetch-depth: 0 from checkout; it existed only for the diff.
• Guard the grep so a PR with no module files doesn't fail the step under pipefail.

Validation

Against #1034 directly: the files API returns only windows-rdp paths, while the old base.sha diff on the same PR spans dozens of unrelated commits including the git-clone change.

🤖 Generated with Coder Agents

[linear-code]

REG-74

[matifali]

Lets test it 🤞🏼