Skip to content

Let workflow 1 run on pull requests from forks - #100

Open
marvinm2 wants to merge 1 commit into
mainfrom
fork-pr-checkout
Open

Let workflow 1 run on pull requests from forks#100
marvinm2 wants to merge 1 commit into
mainfrom
fork-pr-checkout

Conversation

@marvinm2

@marvinm2 marvinm2 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Workflow 1 runs on pull_request_target, and two of its jobs check out refs/pull/N/head. actions/checkout v6 refuses that, so both fail at their first step for any pull request from a fork. Same-repo pull requests are unaffected, which is why it has not come up before.

Changes:

  • get-gpml fetches the GPML over the API instead of checking it out. The file is read as data, and the generators already run from base code via the gpml-file artifact, so no fork code is executed. GH_REPO is added because without a checkout gh has no remote to infer the repository from.
  • update-pr-desc never used its checkout. It reads job outputs and runs gh pr edit, so the step is removed.
  • The git push in Get branch name needed a working tree. Nothing consumes the branch-name output and workflow 3a checks out main, so it is removed as well.

I did not use allow-unsafe-pr-checkout. This workflow holds the deploy keys, and checking out fork code there is the risk the refusal exists to prevent.

Tested on a fork of the sandbox repo: run 30906919228, all ten jobs green on a real cross-repository pull request. A workflow_dispatch re-run does not test this, since it runs in the base context with a full token.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant