ci: opt in to allow-unsafe-pr-checkout for fork PR warehouse tests

[haritamar]

Summary

actions/checkout now refuses to check out fork PR code under pull_request_target unless allow-unsafe-pr-checkout: true is set (see the equivalent failure in elementary: run 31641925693), which breaks the cloud warehouse test jobs for fork PRs here too.

Our pull_request_target usage is intentional: the cloud integration tests need the CI secrets of our test warehouses, which a fork's pull_request run cannot access. test-all-warehouses.yml gates fork PRs behind the elementary_test_env environment (approve-fork job), so a maintainer must approve the run before the fork code is checked out and executed.

So the checkout of the PR head (Checkout dbt package) opts in explicitly, with a comment recording the rationale. Paired with elementary-data/elementary#2317.

Link to Devin session: https://app.devin.ai/sessions/9cfcaa3435b64897992abc30956db12a
Requested by: @haritamar

Summary by CodeRabbit

• Chores
  • Improved pull request validation workflows to support package checkout in approved fork-based builds.
  • Added safeguards and guidance requiring approved CI credentials before code from forked pull requests can execute.
  • Clarified the intended validation flow for contributions submitted from external repositories.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 @haritamar
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in the elementary repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 09e2abc2-1bbf-4994-8d95-8b78fcf27a79

📥 Commits

Reviewing files that changed from the base of the PR and between 1b99689 and 901f55d.

📒 Files selected for processing (1)

• .github/workflows/test-warehouse.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/test-warehouse.yml

---

📝 Walkthrough

Walkthrough

The warehouse test workflow now disables credential persistence and enables unsafe dbt package checkout for fork pull requests. Comments document the required approved CI secrets.

Changes

Warehouse workflow

Layer / File(s)	Summary
Enable fork PR checkout .github/workflows/test-warehouse.yml	The workflow documents the fork pull request checkout flow, sets persist-credentials: false, and enables allow-unsafe-pr-checkout: true for the dbt package checkout.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to 901f5

This localized workflow change enables the intended gated cloud warehouse tests for fork pull requests; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes enabling unsafe checkout for fork pull request warehouse tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1786570188-allow-unsafe-pr-checkout

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/test-warehouse.yml (1)

95-95: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update actionlint or suppress this diagnostic.

actionlint 1.7.12 predates allow-unsafe-pr-checkout, but actions/checkout@v6 defines this security input. If actionlint runs as a required check, upgrade it or add a targeted ignore. Keep the input.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-warehouse.yml at line 95, Update the workflow linting
configuration for the diagnostic on allow-unsafe-pr-checkout: either upgrade
actionlint to a version recognizing this actions/checkout@v6 input or add a
targeted suppression for this specific diagnostic. Preserve the
allow-unsafe-pr-checkout input unchanged.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test-warehouse.yml:
- Around line 89-95: Update both actions/checkout invocations in the workflow to
set persist-credentials to false, ensuring no GitHub credentials remain
configured before executing fork-controlled code; preserve the existing
allow-unsafe-pr-checkout and approval-gating behavior.

---

Nitpick comments:
In @.github/workflows/test-warehouse.yml:
- Line 95: Update the workflow linting configuration for the diagnostic on
allow-unsafe-pr-checkout: either upgrade actionlint to a version recognizing
this actions/checkout@v6 input or add a targeted suppression for this specific
diagnostic. Preserve the allow-unsafe-pr-checkout input unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1ed46cab-a46f-4115-bdaf-6f52e32aff71

📥 Commits

Reviewing files that changed from the base of the PR and between c11e511 and 1b99689.

📒 Files selected for processing (1)

• .github/workflows/test-warehouse.yml