Skip to content

docs: replace pull_request_target fork-PR guidance #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
finalerock44 merged 1 commit into from
Nov 9, 2026
Merged

docs: replace pull_request_target fork-PR guidance #165

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 11 additions & 12 deletions ci-cd/github-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,26 +27,25 @@ on:
branches: [main]
```

::: warning
If you use `pull_request_target` to run tests from forked PRs, explicitly check out the PR HEAD to ensure you're testing the changed code. Be aware that `pull_request_target` runs with your repository's secrets, including your DeviceCloud API key, so anything the job runs from a fork's checkout (build scripts, and the flows themselves) runs with access to them. Only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.
:::
### Pull requests from forks

GitHub doesn't pass secrets to `pull_request` runs from a fork, so `DCD_API_KEY` is empty and the DeviceCloud step fails. To skip the job on fork PRs instead of failing it, add a condition to the job:

```yaml
on:
push:
branches: [main]
pull_request_target:
branches: [main]
jobs:
run-maestro-on-dcd:
name: Run Flows on DeviceCloud
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
ref: ${{ github.event.pull_request.head.sha }}
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
```

We don't recommend switching to `pull_request_target` to test forks. It runs with your repository's secrets, including your DeviceCloud API key, so a fork's build scripts and flows would run with access to them. GitHub also restricts it now:

- Since 20 July 2026, `actions/checkout` refuses to check out a fork's code in a `pull_request_target` run unless you set its `allow-unsafe-pr-checkout` input.

@claude claude Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Flagging this for confirmation, as CLAUDE.md asks: "Flag a doc change that names a flag, input or endpoint the rest of the docs don't use, so a reviewer can confirm it exists."

allow-unsafe-pr-checkout doesn't appear anywhere else in the docs. Please check these against the actions/checkout README and GitHub's changelog:

  • the input name
  • the 20 July 2026 date
  • the 2 December 2026 date
  • the Settings > Actions > Policies path on line 45

docs/ci-cd/github-actions.md

Lines 43 to 45 in 6d8e91e

- Since 20 July 2026, `actions/checkout` refuses to check out a fork's code in a `pull_request_target` run unless you set its `allow-unsafe-pr-checkout` input.
- From 2 December 2026, GitHub blocks `pull_request_target` in public repositories unless an Actions policy (**Settings** > **Actions** > **Policies**) allows it.

- From 2 December 2026, GitHub blocks `pull_request_target` in public repositories unless an Actions policy (**Settings** > **Actions** > **Policies**) allows it.

If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.

@claude claude Bot Nov 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These steps no longer tell readers to check out the PR's code. Under pull_request_target, actions/checkout checks out the base branch by default. allow-unsafe-pr-checkout only lifts the block on fork checkouts. It doesn't fetch the fork's commit. Someone who follows these steps exactly will test the base branch on every fork PR, so the runs look fine but never test the fork's changes.

The old example covered this with ref: ${{ github.event.pull_request.head.sha }}, which this PR removes. Pinning to the head SHA also means the approved run tests the commit that was reviewed.

Suggested change
If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.
If you still need it, allow the event for that workflow in an Actions policy, set `ref: ${{ github.event.pull_request.head.sha }}` and `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.

docs/ci-cd/github-actions.md

Lines 46 to 48 in 6d8e91e

If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment.


## Platform Examples

### Android
Expand Down
Loading