diff options
| author | Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> | 2026-07-07 16:34:20 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-07 16:34:20 -0400 |
| commit | 90723f5985926a25e7ccfe67fdcc242120503361 (patch) | |
| tree | 92a4aed0b546c9c0491db68429b257446af5cad1 /README.md | |
| parent | cbb53fba03ddd47df04de3ef6bcd9f7cc3551165 (diff) | |
backport `allow-unsafe-pr-checkout` to v3 (#2503)
* block checking out fork pr for pull_request_target and workflow_run (#2454)
* block checking out fork pr for some events
* address copilot and reviewer feedback
* run prettier formatting
* build
* update urls
* update readme
* update description and url again
* edit url one more time
* update error wording (#2467)
* Upgrade upload-artifact action to version 4
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -114,6 +114,15 @@ When Git 2.18 or higher is not in your PATH, falls back to the REST API to downl # running from unless specified. Example URLs are https://github.com or # https://my-ghes-server.example.com github-server-url: '' + + # Required to check out fork pull request code from a workflow triggered by + # `pull_request_target` or `workflow_run`. These workflows run with the base + # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner + # access; fetching and executing a fork's code in that trusted context commonly + # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the + # risks at https://gh.io/securely-using-pull_request_target. + # Default: false + allow-unsafe-pr-checkout: '' ``` <!-- end usage --> |