fix: add repository parameter to checkout steps for fork PR compatibi…

[BLumia]

…lity for cppcheck.yml

This amends 10499fb

Log:

Summary by Sourcery

CI:

• Upgrade the cppcheck workflow to use actions/checkout@v7 with explicit repository and unsafe PR checkout settings for fork compatibility.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the cppcheck GitHub Actions workflow checkout step to support forked pull requests by upgrading the checkout action and specifying repository and safety options.

Sequence diagram for updated cppcheck workflow checkout behavior

sequenceDiagram
    participant GitHub
    participant cppcheck_workflow
    participant actions_checkout_v7
    participant action_cppcheck

    GitHub->>cppcheck_workflow: trigger pull_request
    cppcheck_workflow->>actions_checkout_v7: uses actions/checkout@v7
    actions_checkout_v7-->>actions_checkout_v7: ref = github.event.pull_request.head.sha
    actions_checkout_v7-->>actions_checkout_v7: repository = github.event.pull_request.head.repo.full_name
    actions_checkout_v7-->>actions_checkout_v7: allow-unsafe-pr-checkout = true
    actions_checkout_v7-->>cppcheck_workflow: workspace prepared from PR head
    cppcheck_workflow->>action_cppcheck: uses linuxdeepin/action-cppcheck@main
    action_cppcheck-->>GitHub: report cppcheck results

Loading

File-Level Changes

Change	Details	Files
Update the checkout step in the cppcheck workflow to correctly fetch code from forked pull request repositories using the latest checkout action and additional parameters.	Upgrade actions/checkout from v4 to v7 in the workflow Continue checking out the PR head by using github.event.pull_request.head.sha as ref Add repository parameter pointing to github.event.pull_request.head.repo.full_name for fork compatibility Enable allow-unsafe-pr-checkout to permit checking out code from forks under controlled conditions Keep persist-credentials set to false to avoid storing GitHub token in the local git config	workflow-templates/cppcheck.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Switching to actions/checkout@v7 may break if that tag doesn’t exist or changes behavior; consider pinning to a known released major version or a specific commit for stability.
• Enabling allow-unsafe-pr-checkout: true introduces additional risk for untrusted fork PRs; it would be good to explicitly justify this in the workflow or scope it to trusted events only.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Switching to `actions/checkout@v7` may break if that tag doesn’t exist or changes behavior; consider pinning to a known released major version or a specific commit for stability.
- Enabling `allow-unsafe-pr-checkout: true` introduces additional risk for untrusted fork PRs; it would be good to explicitly justify this in the workflow or scope it to trusted events only.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: BLumia, zccrs

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

deepin pr auto review

★ 总体评分：40分

■ 【总体评价】

代码更新了CI检出配置以支持Fork仓库的PR，但引入了不安全的检出选项
逻辑正确但因开启不安全PR检出导致供应链攻击风险扣60分

■ 【详细分析】

• 1.语法逻辑（完全正确）✓

YAML 语法正确，actions/checkout@v7 的参数配置符合 GitHub Actions 规范，正确使用了 repository 和 allow-unsafe-pr-checkout 参数。
潜在问题：无
建议：无需修改

• 2.代码质量（良好）✓

配置项清晰，明确指定了检出所需的 ref 和 repository，结构合理，符合 CI 配置规范。
潜在问题：缺少对为何开启 allow-unsafe-pr-checkout 的注释说明
建议：在配置上方添加注释说明开启此选项的原因及潜在风险

• 3.代码性能（无性能问题）✓

升级到 v7 版本的 checkout 动作通常具有更好的性能和稳定性，对整体 CI 流程性能无负面影响。
潜在问题：无
建议：无需修改

• 4.代码安全（存在1个安全漏洞）✕

漏洞对比统计：新增漏洞 1 个，减少漏洞 0 个，持平 0 个
开启 allow-unsafe-pr-checkout: true 允许在 CI 环境中检出来自 Fork 仓库的不可信代码，若后续步骤（如 linuxdeepin/action-cppcheck）执行了该代码或存在代码注入，将导致严重的安全风险。

• 安全漏洞1（高危）：不安全的PR检出 在 workflow-templates/cppcheck.yml 中，通过设置 allow-unsafe-pr-checkout: true，允许检出并可能执行来自任意 Fork 仓库的 Pull Request 代码，攻击者可通过提交恶意 PR 触发 CI 流程，导致敏感信息泄露或 CI 环境被控制 ——非常重要

• 建议：尽量避免使用 allow-unsafe-pr-checkout: true。如果必须支持 Fork 仓库的 PR 检查，应确保后续所有步骤均在隔离环境中运行，且不执行任何项目构建脚本或测试脚本。或者限制仅对特定信任的仓库开启此选项。

■ 【改进建议代码示例】

diff --git a/workflow-templates/cppcheck.yml b/workflow-templates/cppcheck.yml
index f41da53e7..7915f23a7 100644
--- a/workflow-templates/cppcheck.yml
+++ b/workflow-templates/cppcheck.yml
@@ -14,9 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: export
-      - uses: actions/checkout@v4
+      # 注意：开启 allow-unsafe-pr-checkout 以支持 Fork 仓库 PR 检查
+      # 请确保后续步骤不执行不可信代码
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           persist-credentials: false
       - uses: linuxdeepin/action-cppcheck@main
         with:

[deepin-ci-robot]

@BLumia: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
github-pr-review-ci	8479482	link	true	/test github-pr-review-ci

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.