cicd/checkout
1
0
Fork 0
mirror of https://github.com/actions/checkout.git synced 2026-07-07 15:55:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

block checking out fork pr for pull_request_target and workflow_run (#2454)

Browse Source 
* block checking out fork pr for some events

* address copilot and reviewer feedback

* run prettier formatting

* build

* update urls

* update readme

* update description and url again

* edit url one more time
This commit is contained in:
Aiqiao Yan
2026-06-16 10:03:43 -04:00
parent ee0669bd1c
commit 2e578352d9
10 changed files with 509 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -110,6 +110,15 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous
# config --global --add safe.directory <path>`
# Default: true
set-safe-directory: ''
# Required to check out fork pull request code from a workflow triggered by
# `pull_request_target` or `workflow_run`. These workflows run with the base
# repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
# access; fetching and executing a fork's code in that trusted context commonly
# leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
# risks at https://gh.io/securely-using-pull_request_target.
# Default: false
allow-unsafe-pr-checkout: ''
```
<!-- end usage -->