The default `ref` is the one which triggers the action. Consequently the
` Update rules number badge` commit from the `update_num_rules` job is
not synchronized.
Do not checkout `tests/data` submodule. Instead checkout only
`capa-rules`. This also automatically checkouts the correct version
without needing to update the submodule after the checkout (as it uses
`$GITHUB_SHA`).
- Do not include `CAPA_TOKEN` token as capa is a public repo and token
is not needed for checkout.
- Do not checkout `tests/data` submodule. Instead checkout only
`capa-rules`. This also automatically checkouts the correct version
without needing to update the submodule after the checkout (as it uses
`$GITHUB_SHA`).