Anton Vinogradov created IGNITE-28913:
-----------------------------------------
Summary: GitHub Actions commit checks fail for all fork PRs:
checkout refuses pull_request_target
Key: IGNITE-28913
URL: https://issues.apache.org/jira/browse/IGNITE-28913
Project: Ignite
Issue Type: Task
Reporter: Anton Vinogradov
Assignee: Anton Vinogradov
Since the GitHub Actions runner image update (~2026-07-14), actions/checkout
refuses to check out fork PR code in a pull_request_target workflow by default
(the new "pwn request" guard) and fails with:
Refusing to check out fork pull request code from a 'pull_request_target'
workflow. ... To opt in, review the risks at
https://gh.io/securely-using-pull_request_target and set
'allow-unsafe-pr-checkout: true' on the actions/checkout step.
As a result every job of commit-check.yml (Code Style, Abandoned Tests,
Javadocs; .NET; ducktape) fails on the checkout step for every fork pull
request — i.e. for all contributor PRs.
commit-check.yml uses pull_request_target deliberately (the in-file comment: so
the checks also run when the PR conflicts with the base branch) and is already
hardened for it: the workflow declares "permissions: contents: read" and
documents that no secrets may be added. The untrusted-code risk the new guard
protects against is therefore already consciously mitigated.
Fix: add "allow-unsafe-pr-checkout: true" to each actions/checkout step that
checks out github.event.pull_request.head.sha, acknowledging the documented
trade-off. (The alternative — switching the trigger to pull_request — would
lose the ability to check conflicting PRs, which the workflow explicitly wants.)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
