fix: add allow-unsafe-pr-checkout: true to checkout steps#794
Conversation
When checking out from fork repos, the allow-unsafe-pr-checkout option must be set to true to allow actions/checkout to fetch from the fork repository.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR updates multiple GitHub Actions workflows to explicitly enable unsafe PR checkouts when using forked repositories with pull_request_target, ensuring actions/checkout works with refs from fork PRs. Sequence diagram for GitHub Actions fork PR checkout with allow-unsafe-pr-checkoutsequenceDiagram
actor Developer
participant GitHubActions
participant actions_checkout
participant ForkRepo
Developer->>GitHubActions: open pull_request_target from fork
GitHubActions->>actions_checkout: run with ref head_sha
GitHubActions->>actions_checkout: set allow-unsafe-pr-checkout true
actions_checkout->>ForkRepo: checkout repository head_repo_full_name at head_sha
actions_checkout-->>GitHubActions: repository checked out for workflow job
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin pr auto review★ 总体评分：40分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 # 错误示例（当前代码）：
# - uses: actions/checkout@v7
# if: ${{ github.event_name == 'pull_request' }}
# with:
# ref: ${{ github.event.pull_request.head.sha }}
# repository: ${{ github.event.pull_request.head.repo.full_name }}
# allow-unsafe-pr-checkout: true
# persist-credentials: false
# 修复建议：针对不同场景分离处理，避免在含有 secrets 的流程中直接执行 fork 代码
# 对于仅做代码检查的 job，可以保留拉取，但绝对不能在此 job 中注入任何 secrets
- uses: actions/checkout@v7
if: ${{ github.event_name == 'pull_request' }}
with:
ref: ${{ github.event.pull_request.head.sha }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
persist-credentials: false
# 移除 allow-unsafe-pr-checkout: true
# 对于需要 secrets 的构建或发布 job，应基于基座分支检出，并手动合并 PR 代码，或使用 pull_request_target
- uses: actions/checkout@v7
if: ${{ github.event_name == 'pull_request_target' }}
with:
ref: ${{ github.base_ref }}
persist-credentials: false
- name: Merge PR
run: |
git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
git merge --no-ff pr-head |
|
@deepin-ci-robot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: BLumia, deepin-ci-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Given how often this
actions/checkoutconfiguration is repeated, consider extracting it into a reusable workflow or composite action to reduce duplication and keep future changes (e.g., toallow-unsafe-pr-checkout) in one place. - It may help future maintainers if you add a brief inline comment near the
allow-unsafe-pr-checkout: truelines explaining that this is required for fork PRs usingpull_request_targetwithrepositoryoverrides, so it’s not mistaken for an unnecessary security relaxation.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Given how often this `actions/checkout` configuration is repeated, consider extracting it into a reusable workflow or composite action to reduce duplication and keep future changes (e.g., to `allow-unsafe-pr-checkout`) in one place.
- It may help future maintainers if you add a brief inline comment near the `allow-unsafe-pr-checkout: true` lines explaining that this is required for fork PRs using `pull_request_target` with `repository` overrides, so it’s not mistaken for an unnecessary security relaxation.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
3 participants
Problem
When using
pull_request_targetwithrepository: ${{ github.event.pull_request.head.repo.full_name }}to checkout from a fork, theactions/checkoutaction requiresallow-unsafe-pr-checkout: trueto be explicitly set.Without this option, the checkout may fail for fork PRs due to security restrictions.
Changes
Add
allow-unsafe-pr-checkout: trueto allactions/checkoutsteps that useref: ${{ github.event.pull_request.head.sha }}andrepository: ${{ github.event.pull_request.head.repo.full_name }}.auto-tag.ymlbuild-distribution.ymlcommitlint.ymldoc-check.ymldtk-unittest.ymllicense-check.ymlSummary by Sourcery
CI: