From 0d9a899c002981d9e0ec7d7ee04c88a5c852c778 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 21:29:29 +0000 Subject: [PATCH 1/2] ci: set allow-unsafe-pr-checkout on fork PR checkout in test-warehouse Co-Authored-By: Itamar Hartstein --- .github/workflows/test-warehouse.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/test-warehouse.yml b/.github/workflows/test-warehouse.yml index 0e34c0c2e..322e5e845 100644 --- a/.github/workflows/test-warehouse.yml +++ b/.github/workflows/test-warehouse.yml @@ -97,6 +97,14 @@ jobs: with: path: elementary ref: ${{ inputs.elementary-ref }} + # Fork PRs are tested via pull_request_target intentionally: the + # integration tests need the CI secrets of our test warehouses, which + # a pull_request run of a fork cannot access. The caller + # (test-all-warehouses.yml) gates fork PRs behind the + # elementary_test_env environment, so a maintainer must approve the + # run before this fork code is checked out and executed, and only an + # explicit allowlist of secrets is passed in. + allow-unsafe-pr-checkout: true - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 From 98db355a74c54f8eb6dbf4b12a78e9003fcb06c3 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 21:37:34 +0000 Subject: [PATCH 2/2] ci: don't persist git credentials for fork PR checkouts Co-Authored-By: Itamar Hartstein --- .github/workflows/test-warehouse.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/test-warehouse.yml b/.github/workflows/test-warehouse.yml index 322e5e845..6326f6bce 100644 --- a/.github/workflows/test-warehouse.yml +++ b/.github/workflows/test-warehouse.yml @@ -97,6 +97,9 @@ jobs: with: path: elementary ref: ${{ inputs.elementary-ref }} + # Don't leave the base repo's token in the git config: the checked out + # code is fork-controlled (see below) and nothing here pushes. + persist-credentials: false # Fork PRs are tested via pull_request_target intentionally: the # integration tests need the CI secrets of our test warehouses, which # a pull_request run of a fork cannot access. The caller @@ -118,6 +121,7 @@ jobs: repository: elementary-data/dbt-data-reliability path: dbt-data-reliability ref: ${{ inputs.dbt-data-reliability-ref }} + persist-credentials: false - name: Validate workflow inputs run: |