From c865fb70f6fdf09796e8de4a011909eeaff3c173 Mon Sep 17 00:00:00 2001 From: ntkathole Date: Wed, 22 Jul 2026 16:20:58 +0530 Subject: [PATCH] ci: Fix checkout failure in pull_request_target workflows actions/checkout v4.4.0 (released 2026-07-20) backported a security check that blocks checking out fork PR code in pull_request_target workflows by default. This broke pr-integration-tests and pr-registration-integration-tests for all fork PRs. Add allow-unsafe-pr-checkout: true to the 4 affected checkout steps. This is safe because both workflows already gate execution behind maintainer-applied labels (ok-to-test / approved / lgtm) and set persist-credentials: false. Signed-off-by: ntkathole --- .github/workflows/pr_integration_tests.yml | 2 ++ .github/workflows/pr_registration_integration_tests.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/pr_integration_tests.yml b/.github/workflows/pr_integration_tests.yml index 88d5c102250..60d0b13ce72 100644 --- a/.github/workflows/pr_integration_tests.yml +++ b/.github/workflows/pr_integration_tests.yml @@ -49,6 +49,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge submodules: recursive persist-credentials: false + allow-unsafe-pr-checkout: true # Security: gated by label check above - name: Setup Python uses: actions/setup-python@v5 id: setup-python @@ -108,6 +109,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge submodules: recursive persist-credentials: false + allow-unsafe-pr-checkout: true # Security: gated by label check above - name: Setup Python uses: actions/setup-python@v5 with: diff --git a/.github/workflows/pr_registration_integration_tests.yml b/.github/workflows/pr_registration_integration_tests.yml index 81801b643b6..d1744249fc1 100644 --- a/.github/workflows/pr_registration_integration_tests.yml +++ b/.github/workflows/pr_registration_integration_tests.yml @@ -27,6 +27,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge submodules: recursive persist-credentials: false + allow-unsafe-pr-checkout: true # Security: gated by label check above - name: Setup pixi uses: prefix-dev/setup-pixi@v0.8.1 with: @@ -58,6 +59,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge submodules: recursive persist-credentials: false + allow-unsafe-pr-checkout: true # Security: gated by label check above - name: Authenticate to Google Cloud uses: 'google-github-actions/auth@v2' with: