actions/checkout
1
0
Fork 0
mirror of https://github.com/actions/checkout.git synced 2026-07-11 05:15:06 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

backport allow-unsafe-pr-checkout to v4 (#2502)
Some checks failed
Build and Test / test-proxy (push) Failing after 34s
Details
Build and Test / test-git-container (push) Failing after 10s
Details
Build and Test / test-output (push) Successful in 31s
Details
Build and Test / test-bypass-proxy (push) Failing after 53s
Details
Build and Test / test (ubuntu-latest) (push) Failing after 1m47s
Details
Build and Test / build (push) Failing after 3m3s
Details
Build and Test / test (macos-latest) (push) Has been cancelled
Details
Build and Test / test (windows-latest) (push) Has been cancelled
Details

Browse Source 
* block checking out fork pr for pull_request_target and workflow_run (#2454)

* block checking out fork pr for some events

* address copilot and reviewer feedback

* run prettier formatting

* build

* update urls

* update readme

* update description and url again

* edit url one more time

* update error wording (#2467)
This commit is contained in:
Aiqiao Yan
2026-07-07 16:34:51 -04:00
committed by GitHub
parent 34e114876b
commit c915c33a16
10 changed files with 509 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/input-helper.ts
View File

@@ -2,6 +2,7 @@ import * as core from '@actions/core'
import * as fsHelper from './fs-helper'
import * as github from '@actions/github'
import * as path from 'path'
import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper'
import * as workflowContextHelper from './workflow-context-helper'
import {IGitSourceSettings} from './git-source-settings'
@@ -161,5 +162,18 @@ export async function getInputs(): Promise<IGitSourceSettings> {
result.githubServerUrl = core.getInput('github-server-url')
core.debug(`GitHub Host URL = ${result.githubServerUrl}`)
// Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs)
result.allowUnsafePrCheckout =
(core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
'TRUE'
core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
unsafePrCheckoutHelper.assertSafePrCheckout({
qualifiedRepository,
ref: result.ref,
commit: result.commit,
allowUnsafePrCheckout: result.allowUnsafePrCheckout
})
return result
}