From 5ece657f61b9445b1acb342137e967cd58f766d5 Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Fri, 18 Sep 2026 21:05:33 +0200 Subject: [PATCH] Fix CI Getting this in CI runs, like https://github.com/NixOS/org/actions/runs/31025754088/job/92373643252?pr=276: > Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b3d0f9..85d2352 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,7 @@ jobs: with: ref: refs/pull/${{ github.event.pull_request.number }}/merge path: untrusted-pr + allow-unsafe-pr-checkout: true - uses: serokell/xrefcheck-action@v1 with: @@ -39,6 +40,7 @@ jobs: with: ref: refs/pull/${{ github.event.pull_request.number }}/merge path: untrusted-pr + allow-unsafe-pr-checkout: true - name: Validate codeowners run: result/bin/codeowners-validator