From ce6211c4b078f84d7d8980cb8724e81eabeccb68 Mon Sep 17 00:00:00 2001 From: Lasse Benninga Date: Thu, 30 Jul 2026 10:46:14 +0200 Subject: [PATCH] fix(ci): allow fork PR checkout for Week 11 autograder actions/checkout v6 blocks fork checkouts under pull_request_target unless allow-unsafe-pr-checkout is set. Pin the reusable grader to the same fork-safe workflow as Week 13, and run PR body check via pull_request_target so fork PRs are not stuck on workflow approval. Co-authored-by: Cursor --- .github/workflows/grade-assignment.yml | 6 +++++- .github/workflows/pr-body-check.yml | 7 +++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/grade-assignment.yml b/.github/workflows/grade-assignment.yml index 3fd4b9c..ed3644e 100644 --- a/.github/workflows/grade-assignment.yml +++ b/.github/workflows/grade-assignment.yml @@ -11,4 +11,8 @@ jobs: contents: read issues: write pull-requests: write - uses: HackYourFuture/github-actions/.github/workflows/auto-grade.yml@main + # Temporary pin: actions/checkout v6 blocks fork checkouts under + # pull_request_target unless allow-unsafe-pr-checkout is set. + # Revert to HackYourFuture/github-actions@main after + # https://github.com/HackYourFuture/github-actions/pull/4 merges. + uses: lassebenni/github-actions-fork/.github/workflows/auto-grade.yml@fix/allow-unsafe-pr-checkout-for-autograde diff --git a/.github/workflows/pr-body-check.yml b/.github/workflows/pr-body-check.yml index 8974da5..b3322e2 100644 --- a/.github/workflows/pr-body-check.yml +++ b/.github/workflows/pr-body-check.yml @@ -6,10 +6,17 @@ name: PR body check # the REST API or `gh pr create --body "..."` (the path most AI tools take) # silently skips it. This check is the only thing that actually enforces it. +# Uses pull_request_target (in addition to pull_request) so fork PRs always run +# the workflow from main. The job only reads github.event.pull_request.body — +# it does not check out PR head code. + on: pull_request: types: [opened, edited, reopened, synchronize] branches: [main] + pull_request_target: + types: [opened, edited, reopened, synchronize] + branches: [main] permissions: contents: read