All five pull_request_target workflows (automerge-check, JSON Schema Validation, lint, check-description, label-templates) currently fail within seconds for every fork PR, at the actions/checkout step. Run annotation:
Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. ... To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.
This appears to be a GitHub Actions runner-side policy change. Since pull_request_target runs the base repo's workflow definitions, fork PRs cannot fix or work around it — all contributor PRs are blocked from going green (example: #1444, where all five checks die in 3-10s before any validation runs).
The fix appears to be adding allow-unsafe-pr-checkout: true to the actions/checkout step in each affected workflow. The workflows only run base-repo tooling (dc-template-linter, check-jsonschema, .github/scripts) against changed root-level JSON files rather than executing contributed code, so the risk profile seems acceptable — maintainers' call.
I've opened a PR with the five one-line changes for consideration.
All five pull_request_target workflows (automerge-check, JSON Schema Validation, lint, check-description, label-templates) currently fail within seconds for every fork PR, at the actions/checkout step. Run annotation:
This appears to be a GitHub Actions runner-side policy change. Since pull_request_target runs the base repo's workflow definitions, fork PRs cannot fix or work around it — all contributor PRs are blocked from going green (example: #1444, where all five checks die in 3-10s before any validation runs).
The fix appears to be adding
allow-unsafe-pr-checkout: trueto the actions/checkout step in each affected workflow. The workflows only run base-repo tooling (dc-template-linter, check-jsonschema, .github/scripts) against changed root-level JSON files rather than executing contributed code, so the risk profile seems acceptable — maintainers' call.I've opened a PR with the five one-line changes for consideration.