Skip to content

ci: opt in to allow-unsafe-pr-checkout for fork PR warehouse tests #2324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
haritamar wants to merge 2 commits into
base: master
Choose a base branch
from
Open

ci: opt in to allow-unsafe-pr-checkout for fork PR warehouse tests #2324

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0d9a899
ci: set allow-unsafe-pr-checkout on fork PR checkout in test-warehouse
devin-ai-integration[bot] Aug 12, 2026
98db355
ci: don't persist git credentials for fork PR checkouts
devin-ai-integration[bot] Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/test-warehouse.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,17 @@ jobs:
with:
path: elementary
ref: ${{ inputs.elementary-ref }}
# Don't leave the base repo's token in the git config: the checked out
# code is fork-controlled (see below) and nothing here pushes.
persist-credentials: false
# Fork PRs are tested via pull_request_target intentionally: the
# integration tests need the CI secrets of our test warehouses, which
# a pull_request run of a fork cannot access. The caller
# (test-all-warehouses.yml) gates fork PRs behind the
# elementary_test_env environment, so a maintainer must approve the
# run before this fork code is checked out and executed, and only an
# explicit allowlist of secrets is passed in.
allow-unsafe-pr-checkout: true
Comment thread
coderabbitai[bot] marked this conversation as resolved.

@coderabbitai coderabbitai Bot Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml |
  grep -A8 '^allow-unsafe-pr-checkout:'

actionlint .github/workflows/test-warehouse.yml

Repository: elementary-data/elementary

Length of output: 164

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- workflow context ---'
sed -n '85,120p' .github/workflows/test-warehouse.yml

printf '%s\n' '--- checkout references ---'
rg -n -C 2 'actions/checkout|allow-unsafe-pr-checkout|actionlint' .github . 2>/dev/null | head -200

printf '%s\n' '--- actionlint availability ---'
if command -v actionlint >/dev/null 2>&1; then
  actionlint --version
  actionlint .github/workflows/test-warehouse.yml
  printf 'actionlint_exit=%s\n' "$?"
else
  printf '%s\n' 'actionlint: not installed'
fi

printf '%s\n' '--- checkout v6 metadata ---'
if command -v curl >/dev/null 2>&1; then
  curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml | \
    awk '/^[[:space:]]*allow-unsafe-pr-checkout:/,/^[[:space:]]*[A-Za-z0-9_-]+:/{print}' | head -10
  printf 'curl_exit=%s\n' "$?"
else
  printf '%s\n' 'curl: not installed'
fi

Repository: elementary-data/elementary

Length of output: 8102

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- actionlint references and configuration ---'
rg -n -C 3 'actionlint|reviewdog|rhysd|workflow-files|actions/checkout' \
  .github Makefile* justfile* Taskfile* package.json pyproject.toml .pre-commit-config.yaml 2>/dev/null | head -300

printf '%s\n' '--- actionlint help and embedded metadata clues ---'
actionlint -help 2>&1 | head -120

printf '%s\n' '--- checkout v6 metadata ---'
curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml | \
  sed -n '/allow-unsafe-pr-checkout/,+8p'

printf '%s\n' '--- checkout v6 ref resolution ---'
curl -fsSL https://api.github.com/repos/actions/checkout/git/ref/tags/v6 \
  -H 'Accept: application/vnd.github+json' | jq '{ref, object}'
curl -fsSL https://api.github.com/repos/actions/checkout/releases/tags/v6.1.0 \
  -H 'Accept: application/vnd.github+json' | jq '{tag_name, published_at, target_commitish, body}'

printf '%s\n' '--- actionlint releases ---'
curl -fsSL https://api.github.com/repos/rhysd/actionlint/releases/tags/1.7.12 \
  -H 'Accept: application/vnd.github+json' | jq '{tag_name, published_at, target_commitish, body}'

Repository: elementary-data/elementary

Length of output: 10422

Update actionlint metadata or upgrade actionlint.

actions/checkout@v6 defines allow-unsafe-pr-checkout, but actionlint 1.7.12 does not recognize it. Keep the input and align the linter metadata with the action version used by CI.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 107-107: input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v6". available inputs are "clean", "fetch-depth", "fetch-tags", "filter", "github-server-url", "lfs", "path", "persist-credentials", "ref", "repository", "set-safe-directory", "show-progress", "sparse-checkout", "sparse-checkout-cone-mode", "ssh-key", "ssh-known-hosts", "ssh-strict", "ssh-user", "submodules", "token"

(action)

🪛 zizmor (1.29.0)

[warning] 95-107: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-warehouse.yml at line 107, Update the actionlint
metadata or upgrade actionlint so it recognizes the allow-unsafe-pr-checkout
input used with actions/checkout@v6. Preserve the existing
allow-unsafe-pr-checkout configuration and align the linter’s action metadata
with the checkout version used by CI.

Source: Linters/SAST tools

@devin-ai-integration devin-ai-integration Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not actionable here: this repo doesn't run actionlint in CI or pre-commit, so there's no metadata to align or version to bump — the diagnostic is from CodeRabbit's own actionlint 1.7.12, which predates allow-unsafe-pr-checkout (added in actions/checkout v6.1.0). Keeping the input.

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: comment is from another GitHub bot.


- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
Expand All @@ -110,6 +121,7 @@ jobs:
repository: elementary-data/dbt-data-reliability
path: dbt-data-reliability
ref: ${{ inputs.dbt-data-reliability-ref }}
persist-credentials: false

- name: Validate workflow inputs
run: |
Expand Down
Loading