Skip to content

[repo] Opt into fork checkout for validate-plugin under checkout@v6 #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SergeantPanda merged 1 commit into from
Jul 21, 2026
Merged

[repo] Opt into fork checkout for validate-plugin under checkout@v6 #189

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/validate-plugin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,9 @@ jobs:
sparse-checkout: plugins
sparse-checkout-cone-mode: false
clean: false
# Fork content is only read as data (sparse plugins/), never executed;
# trusted scripts are saved/restored around this step.
allow-unsafe-pr-checkout: true

- name: Restore trusted scripts
run: mkdir -p .github && cp -r /tmp/trusted-scripts .github/scripts
Expand Down Expand Up @@ -423,6 +426,8 @@ jobs:
# (actions/checkout doesn't support dynamic expressions in sparse-checkout)
sparse-checkout: .gitignore
sparse-checkout-cone-mode: false
# Merge ref is analyzed statically by CodeQL only; fork code is not executed.
allow-unsafe-pr-checkout: true

- name: Limit checkout to changed plugin folders only
run: |
Expand Down Expand Up @@ -827,6 +832,8 @@ jobs:
ref: refs/pull/${{ github.event.pull_request.number }}/merge
sparse-checkout: .gitignore
sparse-checkout-cone-mode: false
# Merge ref is only virus-scanned by ClamAV; fork code is not executed.
allow-unsafe-pr-checkout: true

- name: Limit checkout to changed plugin folders only
run: |
Expand Down Expand Up @@ -1047,6 +1054,9 @@ jobs:
sparse-checkout: plugins
sparse-checkout-cone-mode: false
clean: false
# Fork content is only read as data (sparse plugins/), never executed;
# trusted scripts are saved/restored around this step.
allow-unsafe-pr-checkout: true

- name: Restore trusted scripts
run: mkdir -p .github && cp -r /tmp/trusted-scripts .github/scripts
Expand Down
Loading