actions/checkout
3
0
Fork 0
mirror of https://code.forgejo.org/actions/checkout.git synced 2026-07-14 07:15:41 +00:00
Code Activity

block checking out fork pr for pull_request_target and workflow_run (#2454)

Browse source 
* block checking out fork pr for some events

* address copilot and reviewer feedback

* run prettier formatting

* build

* update urls

* update readme

* update description and url again

* edit url one more time
This commit is contained in:
Aiqiao Yan 2026-06-16 10:03:43 -04:00
parent ee0669bd1c
commit 2e578352d9
10 changed files with 509 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
action.yml
View file

@ -71,6 +71,15 @@ inputs:
set-safe-directory:
description: Add repository path as safe.directory for Git global config by running `git config --global --add safe.directory <path>`
default: true
allow-unsafe-pr-checkout:
description: >
Required to check out fork pull request code from a workflow triggered by
`pull_request_target` or `workflow_run`. These workflows run with the
base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
runner access; fetching and executing a fork's code in that trusted
context commonly leads to "pwn request" vulnerabilities. Set to `true`
only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
default: false
runs:
using: node12
main: dist/index.js