From 76455ef5af5e6c1ef9b1743192c21303bad9dbfc Mon Sep 17 00:00:00 2001
From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com>
Date: Wed, 15 Jul 2026 10:02:03 -0400
Subject: skip running unsafe pr check if input is default (#2518)

---
 dist/index.js | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

(limited to 'dist')

diff --git a/dist/index.js b/dist/index.js
index b381bd2..cc25215 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -42191,12 +42191,19 @@ async function getInputs() {
         (getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
             'TRUE';
     core_debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-    assertSafePrCheckout({
-        qualifiedRepository,
-        ref: result.ref,
-        commit: result.commit,
-        allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    });
+    // The default self-checkout (this repository with no explicit ref) always
+    // resolves to the trusted ref/commit GitHub set for the triggering event, so
+    // the fork-checkout guard only needs to run when the caller customized the
+    // repository or ref.
+    const isDefaultCheckout = isWorkflowRepository && !getInput('ref');
+    if (!isDefaultCheckout) {
+        assertSafePrCheckout({
+            qualifiedRepository,
+            ref: result.ref,
+            commit: result.commit,
+            allowUnsafePrCheckout: result.allowUnsafePrCheckout
+        });
+    }
     return result;
 }
 
-- 
cgit v1.2.3