From ced100813c147e2fc3ca692ddc52876ed2358c51 Mon Sep 17 00:00:00 2001
From: Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:34:16 -0400
Subject: backport `allow-unsafe-pr-checkout` to v2 (#2504)

* block checking out fork pr for pull_request_target and workflow_run (#2454)

* block checking out fork pr for some events

* address copilot and reviewer feedback

* run prettier formatting

* build

* update urls

* update readme

* update description and url again

* edit url one more time

* update error wording (#2467)

* bump upload-artifact

* rebuild
---
 src/input-helper.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'src/input-helper.ts')

diff --git a/src/input-helper.ts b/src/input-helper.ts
index 8c2f901..1a090c7 100644
--- a/src/input-helper.ts
+++ b/src/input-helper.ts
@@ -2,6 +2,7 @@ import * as core from '@actions/core'
 import * as fsHelper from './fs-helper'
 import * as github from '@actions/github'
 import * as path from 'path'
+import * as unsafePrCheckoutHelper from './unsafe-pr-checkout-helper'
 import * as workflowContextHelper from './workflow-context-helper'
 import {IGitSourceSettings} from './git-source-settings'
 
@@ -125,5 +126,19 @@ export async function getInputs(): Promise<IGitSourceSettings> {
   // Set safe.directory in git global config.
   result.setSafeDirectory =
     (core.getInput('set-safe-directory') || 'true').toUpperCase() === 'TRUE'
+
+  // Allow unsafe PR checkout (opt-in for pull_request_target / workflow_run fork PRs)
+  result.allowUnsafePrCheckout =
+    (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
+    'TRUE'
+  core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
+
+  unsafePrCheckoutHelper.assertSafePrCheckout({
+    qualifiedRepository,
+    ref: result.ref,
+    commit: result.commit,
+    allowUnsafePrCheckout: result.allowUnsafePrCheckout
+  })
+
   return result
 }
-- 
cgit v1.2.3