From d2bbe26cfc614dcaae28a68354841c8e24f443be Mon Sep 17 00:00:00 2001 From: CodingAngel1 Date: Mon, 20 Jul 2026 19:03:02 +0000 Subject: [PATCH] fix: add allow-unsafe-pr-checkout to all checkout steps for pull_request_target The CI workflow runs with pull_request_target which refuses to checkout fork PR code by default. Since the workflow explicitly references the PR head SHA (ref), adding allow-unsafe-pr-checkout: true is required for fork PRs to build. This fix must land on main because pull_request_target always runs the workflow from the base branch, not the PR branch. --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7967a13d..ea9d42ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,6 +14,7 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Install Rust uses: dtolnay/rust-toolchain@stable @@ -72,6 +73,7 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Setup Node.js uses: actions/setup-node@v4 @@ -103,6 +105,7 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Setup Node.js uses: actions/setup-node@v4 @@ -139,6 +142,7 @@ jobs: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master