Repository navigation
docs: replace pull_request_target fork-PR guidance - #165
Conversation
The old example checked out a fork's head under pull_request_target. actions/checkout now refuses that unless allow-unsafe-pr-checkout is set, and GitHub blocks pull_request_target by default in public repositories from 2 December 2026. Show how to skip the job on fork PRs instead, and what it takes to keep pull_request_target if you still need it.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| - Since 20 July 2026, `actions/checkout` refuses to check out a fork's code in a `pull_request_target` run unless you set its `allow-unsafe-pr-checkout` input. | ||
| - From 2 December 2026, GitHub blocks `pull_request_target` in public repositories unless an Actions policy (**Settings** > **Actions** > **Policies**) allows it. | ||
|
|
||
| If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment. |
There was a problem hiding this comment.
These steps no longer tell readers to check out the PR's code. Under pull_request_target, actions/checkout checks out the base branch by default. allow-unsafe-pr-checkout only lifts the block on fork checkouts. It doesn't fetch the fork's commit. Someone who follows these steps exactly will test the base branch on every fork PR, so the runs look fine but never test the fork's changes.
The old example covered this with ref: ${{ github.event.pull_request.head.sha }}, which this PR removes. Pinning to the head SHA also means the approved run tests the commit that was reviewed.
| If you still need it, allow the event for that workflow in an Actions policy, set `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment. | |
| If you still need it, allow the event for that workflow in an Actions policy, set `ref: ${{ github.event.pull_request.head.sha }}` and `allow-unsafe-pr-checkout: true` on the checkout step, and only run it on PRs you've reviewed, for example by requiring approval through a GitHub environment. |
Lines 46 to 48 in 6d8e91e
|
|
||
| We don't recommend switching to `pull_request_target` to test forks. It runs with your repository's secrets, including your DeviceCloud API key, so a fork's build scripts and flows would run with access to them. GitHub also restricts it now: | ||
|
|
||
| - Since 20 July 2026, `actions/checkout` refuses to check out a fork's code in a `pull_request_target` run unless you set its `allow-unsafe-pr-checkout` input. |
There was a problem hiding this comment.
Flagging this for confirmation, as CLAUDE.md asks: "Flag a doc change that names a flag, input or endpoint the rest of the docs don't use, so a reviewer can confirm it exists."
allow-unsafe-pr-checkout doesn't appear anywhere else in the docs. Please check these against the actions/checkout README and GitHub's changelog:
- the input name
- the 20 July 2026 date
- the 2 December 2026 date
- the Settings > Actions > Policies path on line 45
Lines 43 to 45 in 6d8e91e
The old example checked out a fork's head under pull_request_target. actions/checkout now refuses that unless allow-unsafe-pr-checkout is set, and GitHub blocks pull_request_target by default in public repositories from 2 December 2026. Show how to skip the job on fork PRs instead, and what it takes to keep pull_request_target if you still need it.