diff options
| author | Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> | 2026-07-07 16:34:20 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-07 16:34:20 -0400 |
| commit | 90723f5985926a25e7ccfe67fdcc242120503361 (patch) | |
| tree | 92a4aed0b546c9c0491db68429b257446af5cad1 /src/input-helper.ts | |
| parent | cbb53fba03ddd47df04de3ef6bcd9f7cc3551165 (diff) | |
backport `allow-unsafe-pr-checkout` to v3 (#2503)
* block checking out fork pr for pull_request_target and workflow_run (#2454)
* block checking out fork pr for some events
* address copilot and reviewer feedback
* run prettier formatting
* build
* update urls
* update readme
* update description and url again
* edit url one more time
* update error wording (#2467)
* Upgrade upload-artifact action to version 4
Diffstat (limited to 'src/input-helper.ts')
| -rw-r--r-- | src/input-helper.ts | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/input-helper.ts b/src/input-helper.ts index 631fbdb..2aa71b1 100644 --- a/src/input-helper.ts +++ b/src/input-helper.ts @@ -2,6 +2,7 @@ import * as core from '@actions/core' import * as fsHelper from './fs-helper' import * as github from '@actions/github' import * as path from 'path' +import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper' import * as workflowContextHelper from './workflow-context-helper' import {IGitSourceSettings} from './git-source-settings' @@ -146,5 +147,18 @@ export async function getInputs(): Promise<IGitSourceSettings> { result.githubServerUrl = core.getInput('github-server-url') core.debug(`GitHub Host URL = ${result.githubServerUrl}`) + // Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs) + result.allowUnsafePrCheckout = + (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() === + 'TRUE' + core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`) + + unsafePrCheckoutHelper.assertSafePrCheckout({ + qualifiedRepository, + ref: result.ref, + commit: result.commit, + allowUnsafePrCheckout: result.allowUnsafePrCheckout + }) + return result } |