ci: Fix checkout failure in pull_request_target workflows

ntkathole · ntkathole · commit c865fb70f6fd · 2026-07-22T16:21:35.000+05:30
actions/checkout v4.4.0 (released 2026-07-20) backported a security
check that blocks checking out fork PR code in pull_request_target
workflows by default. This broke pr-integration-tests and
pr-registration-integration-tests for all fork PRs.

Add allow-unsafe-pr-checkout: true to the 4 affected checkout steps.
This is safe because both workflows already gate execution behind
maintainer-applied labels (ok-to-test / approved / lgtm) and set
persist-credentials: false.

Signed-off-by: ntkathole &lt;nikhilkathole2683@gmail.com&gt;
diff --git a/.github/workflows/pr_integration_tests.yml b/.github/workflows/pr_integration_tests.yml
@@ -49,6 +49,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
           persist-credentials: false
+          allow-unsafe-pr-checkout: true  # Security: gated by label check above
       - name: Setup Python
         uses: actions/setup-python@v5
         id: setup-python
@@ -108,6 +109,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
           persist-credentials: false
+          allow-unsafe-pr-checkout: true  # Security: gated by label check above
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/pr_registration_integration_tests.yml b/.github/workflows/pr_registration_integration_tests.yml
@@ -27,6 +27,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
           persist-credentials: false
+          allow-unsafe-pr-checkout: true  # Security: gated by label check above
       - name: Setup pixi
         uses: prefix-dev/setup-pixi@v0.8.1
         with:
@@ -58,6 +59,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
           persist-credentials: false
+          allow-unsafe-pr-checkout: true  # Security: gated by label check above
       - name: Authenticate to Google Cloud
         uses: 'google-github-actions/auth@v2'
         with:
