From a8797e8cf12030c29980fc03d2aa9566c9d9d2ac Mon Sep 17 00:00:00 2001 From: Seth Van Niekerk Date: Tue, 21 Jul 2026 13:19:09 -0400 Subject: [PATCH] [repo] Opt into fork checkout for validate-plugin under checkout@v6 --- .github/workflows/validate-plugin.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/validate-plugin.yml b/.github/workflows/validate-plugin.yml index 3e9e6dc..b21d602 100644 --- a/.github/workflows/validate-plugin.yml +++ b/.github/workflows/validate-plugin.yml @@ -128,6 +128,9 @@ jobs: sparse-checkout: plugins sparse-checkout-cone-mode: false clean: false + # Fork content is only read as data (sparse plugins/), never executed; + # trusted scripts are saved/restored around this step. + allow-unsafe-pr-checkout: true - name: Restore trusted scripts run: mkdir -p .github && cp -r /tmp/trusted-scripts .github/scripts @@ -423,6 +426,8 @@ jobs: # (actions/checkout doesn't support dynamic expressions in sparse-checkout) sparse-checkout: .gitignore sparse-checkout-cone-mode: false + # Merge ref is analyzed statically by CodeQL only; fork code is not executed. + allow-unsafe-pr-checkout: true - name: Limit checkout to changed plugin folders only run: | @@ -827,6 +832,8 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge sparse-checkout: .gitignore sparse-checkout-cone-mode: false + # Merge ref is only virus-scanned by ClamAV; fork code is not executed. + allow-unsafe-pr-checkout: true - name: Limit checkout to changed plugin folders only run: | @@ -1047,6 +1054,9 @@ jobs: sparse-checkout: plugins sparse-checkout-cone-mode: false clean: false + # Fork content is only read as data (sparse plugins/), never executed; + # trusted scripts are saved/restored around this step. + allow-unsafe-pr-checkout: true - name: Restore trusted scripts run: mkdir -p .github && cp -r /tmp/trusted-scripts .github/scripts