fix(ci): allow safe fork PR checkout in pull_request_target workflows - #35068
Merged
Conversation
actions/checkout v6.1.0 backported a breaking security change that
refuses to check out fork pull request code (by SHA, merge commit, or
refs/pull/*/{head,merge}) in pull_request_target workflows unless
allow-unsafe-pr-checkout is explicitly set. This broke the yarn-lock
diff, changeset feedback, and merge message workflows, none of which
execute the checked-out fork code, so opting back in is safe.
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
backstage-goalie
Bot
added
size:small
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates three pull_request_target GitHub Actions workflows to opt back into checking out fork PR refs under the newer actions/checkout safety defaults, while documenting why doing so is safe for these specific jobs (they only diff/read content or run trusted scripts).
Changes:
- Set
allow-unsafe-pr-checkout: truefor fork PR checkouts in affectedpull_request_targetworkflows. - Add inline comments in each workflow describing why the opt-in remains safe for that job’s behavior.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/automate_yarn-lock-changes.yml |
Opts into unsafe PR checkout for merge ref; workflow only reads/diffs yarn.lock changes. |
.github/workflows/automate_merge_message.yml |
Opts into unsafe PR checkout for merge_commit_sha; job only runs post-merge and executes a trusted script fetched from master. |
.github/workflows/automate_changeset_feedback.yml |
Opts into unsafe PR checkout for merge ref; workflow diffs PR content and posts comments using scoped app credentials. |
freben
approved these changes
Aug 3, 2026
backstage-goalie
Bot
added
waiting-for:merge
awanlin
pushed a commit
to awanlin/backstage
that referenced
this pull request
Aug 3, 2026
…backstage#35068) actions/checkout v6.1.0 backported a breaking security change that refuses to check out fork pull request code (by SHA, merge commit, or refs/pull/*/{head,merge}) in pull_request_target workflows unless allow-unsafe-pr-checkout is explicitly set. This broke the yarn-lock diff, changeset feedback, and merge message workflows, none of which execute the checked-out fork code, so opting back in is safe. Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey, I just made a Pull Request!
actions/checkoutv6.1.0 (backported from v7) now refuses to check out fork pull request code inpull_request_targetworkflows — by head SHA,merge_commit_sha, orrefs/pull/*/{head,merge}— unlessallow-unsafe-pr-checkout: trueis set. This broke three of ourpull_request_targetworkflows that use exactly those checkout patterns:automate_yarn-lock-changes.ymlautomate_changeset_feedback.ymlautomate_merge_message.ymlNone of them execute the checked-out fork code (no install/build/run steps against it — they only diff it or run trusted scripts fetched from
master), andautomate_merge_message.ymlonly runs after the PR is already merged. So opting back in withallow-unsafe-pr-checkout: trueis safe for these, and each has a comment explaining why.See actions/checkout#2500 and https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for background.
✔️ Checklist
Signed-off-byline in the message. (more info)