Secure release-note checks for fork pull requests

[NatElkins]

Summary

• avoid checking out fork pull request heads from the privileged pull_request_target workflow
• read trusted release-note configuration from the base commit and inspect changed-file metadata through the GitHub API
• read candidate release-note Markdown as inert text at the exact pull request head
• discard stale results and avoid posting empty comments
• reduce token permissions and consolidate comment updates on actions/github-script@v9

GitHub backported safer actions/checkout defaults to floating supported major tags on July 20, 2026. The current actions/checkout@v2 step now rejects the fork checkout before the release-note logic runs, as seen in https://github.com/dotnet/fsharp/actions/runs/30010753188/job/89217916202?pr=20031.

Using allow-unsafe-pr-checkout: true would restore the old behavior but would preserve the privileged fork-checkout risk. This change keeps fork contributions working without opting out of that protection.

Validation

• actionlint .github/workflows/check_release_notes.yml
• replayed the shell step against PR Add an experimental flag-gated in-process compile path for hot reload sessions #20031 at its exact head and found the changed compiler release-note file
• replayed against PR Add Roslyn-format EnC CustomDebugInformation codec and portable PDB method CDI emission #20018 with NO_RELEASE_NOTES and produced the expected opt-out result with exit code 0
• replayed with a stale head SHA and confirmed it exits successfully without emitting comment output

Expected check state

The check_release_notes result on this PR is expected to remain red. The pull_request_target event loads its workflow definition from the base branch, so this PR runs the old workflow from main and fails before it can see the fix. The PR cannot validate its own replacement through this event. After this change merges, subsequent pull request events will use the fixed workflow.

Refresh status (2026-07-24)

• Current head: abb68322f3, with dotnet/fsharp main 1dc395ad34 merged.
• All security-review threads are addressed and resolved. The PR is ready for review.
• Validation remains: actionlint, live release-note and opt-out replays, and stale-head rejection.
• This PR's own check_release_notes result is expected to stay red because pull_request_target loads the old workflow from main. That exception is explained in the Expected check state section above.

[NatElkins]

@T-Gro I dug into why this suddenly started failing across the hot reload PRs.

GitHub announced safer defaults for pull_request_target on June 18 and moved enforcement for backported actions/checkout versions to July 20, 2026: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/

This workflow itself had not recently changed. Its last repository change was June 8, but it uses the floating actions/checkout@v2 tag, so it automatically picked up the backported protection. Since pull_request_target runs with the base repository token, checkout now refuses to fetch a fork PR head by default. That is why older fork PRs passed and the current ones all started failing before the release-note logic runs. One example is https://github.com/dotnet/fsharp/actions/runs/30010753188/job/89217916202?pr=20031.

I also verified that NO_RELEASE_NOTES is not causing this. I replayed the updated shell logic against both a PR with release notes and a PR carrying that label, and both completed successfully.

I do not think contributors should stop using forks, and I do not think allow-unsafe-pr-checkout: true is the right fix. This PR keeps the normal fork workflow, reads the trusted configuration from the base commit, and uses the GitHub API to inspect the changed-file list and release-note Markdown at the exact PR head without checking out or executing fork content. It also discards stale results and avoids posting an empty comment.

I validated it with actionlint, a live replay against #20031, an opt-out replay against #20018, and a stale-head replay. I would appreciate your review since you last worked on this workflow.

[github-actions]

🔍 Tooling Safety Check — Affects-Build-Infra
Affects-Build-Infra: modifies .github/workflows/check_release_notes.yml

Generated by PR Tooling Safety Check · opus46 4M · ◷

[T-Gro]

The explanation makes sense. Let me verify any security risks (should be fewer, just need to check against common exploits).
Will merge ASAP, thanks for addressing this @NatElkins 👍