[finalerock44]

The old example checked out a fork's head under pull_request_target. actions/checkout now refuses that unless allow-unsafe-pr-checkout is set, and GitHub blocks pull_request_target by default in public repositories from 2 December 2026. Show how to skip the job on fork PRs instead, and what it takes to keep pull_request_target if you still need it.

[claude]

These steps no longer tell readers to check out the PR's code. Under pull_request_target, actions/checkout checks out the base branch by default. allow-unsafe-pr-checkout only lifts the block on fork checkouts. It doesn't fetch the fork's commit. Someone who follows these steps exactly will test the base branch on every fork PR, so the runs look fine but never test the fork's changes.

The old example covered this with ref: ${{ github.event.pull_request.head.sha }}, which this PR removes. Pinning to the head SHA also means the approved run tests the commit that was reviewed.

Suggested change

	If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.
	If you still need it, allow the event for that workflow in an Actions policy, set `ref: ${{ github.event.pull_request.head.sha }}` and `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.

docs/ci-cd/github-actions.md

Lines 46 to 48 in 6d8e91e

	If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.

[claude]

Flagging this for confirmation, as CLAUDE.md asks: "Flag a doc change that names a flag, input or endpoint the rest of the docs don't use, so a reviewer can confirm it exists."

allow-unsafe-pr-checkout doesn't appear anywhere else in the docs. Please check these against the actions/checkout README and GitHub's changelog:

• the input name
• the 20 July 2026 date
• the 2 December 2026 date
• the Settings > Actions > Policies path on line 45

docs/ci-cd/github-actions.md

Lines 43 to 45 in 6d8e91e

	- Since 20 July 2026, `actions/checkout` refuses to check out a fork's code in a `pull_request_target` run unless you set its `allow-unsafe-pr-checkout` input.
	- From 2 December 2026, GitHub blocks `pull_request_target` in public repositories unless an Actions policy (**Settings** > **Actions** > **Policies**) allows it.