diff options
| author | Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> | 2026-07-07 16:34:55 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-07 16:34:55 -0400 |
| commit | 93e494ef84ba8e3de98da2927beaf09ecfa946d7 (patch) | |
| tree | b4ab56a121f9ee246f6c56289431268452a7f909 /action.yml | |
| parent | f97ee346754f209980bd9c4d3ff3f84e84381a9d (diff) | |
backport `allow-unsafe-pr-checkout` to v5 (#2501)
* block checking out fork pr for pull_request_target and workflow_run (#2454)
* block checking out fork pr for some events
* address copilot and reviewer feedback
* run prettier formatting
* build
* update urls
* update readme
* update description and url again
* edit url one more time
* update error wording (#2467)
Diffstat (limited to 'action.yml')
| -rw-r--r-- | action.yml | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -98,6 +98,15 @@ inputs: github-server-url:
description: The base URL for the GitHub instance that you are trying to clone from, will use environment defaults to fetch from the same instance that the workflow is running from unless specified. Example URLs are https://github.com or https://my-ghes-server.example.com
required: false
+ allow-unsafe-pr-checkout:
+ description: >
+ Required to check out fork pull request code from a workflow triggered by
+ `pull_request_target` or `workflow_run`. These workflows run with the
+ base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
+ runner access; fetching and executing a fork's code in that trusted
+ context commonly leads to "pwn request" vulnerabilities. Set to `true`
+ only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
+ default: false
outputs:
ref:
description: 'The branch, tag or SHA that was checked out'
|