fix(validation): read metadata from head directory instead of base

[okjintao]

No description provided.

[bearpong]

@okjintao just for context:

CI is run triggered pull_request_target meaning that the workflow is run on the base branch if you open a PR against it. pull_request instead would run on the head branch. The reason for that is that pull_request needs manual approval for running when a PR is open from an external user. The design choice here was to use rules on the base branch (main) to validate data on the head branch. Doing so no code is run from the PR which can let us safely use run checks on any PR regardless from its changes.

If we used the code from the head branch, triggered by pull_request_target, anyone could steal secrets of this repo by just making a PR to this repo, w/o need of being merged for instance.

I'm not sure what you're fixing here cause i dont remember the code, but I realize this was prob not documented anywhere, my bad

cc @codingwithmanny @AyveeBera for knowledge