Re: Verify Change Log action failing
Jan Høydahl <[email protected]> Sat, 4 Jul 2026 00:35:27 +0200
| Newsgroups | gmane.comp.jakarta.lucene.devel |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_418F8B51-4573-4ED1-A29C-BD23203BA7BC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 See Solr's renovate-changelog-* workflows=C2=A0 = <https://github.com/apache/solr/tree/main/.github/workflows>which safely = write to a fork's PR branch. We recently converted it from a single = pull_request_target workflow to this two-stage approach to avoid the = security risk. Jan > 3. juli 2026 kl. 14:20 skrev Robert Muir <[email protected]>: >=20 > I was worried this would find something when upgrading to > actions/checkout version. I'd like to change this workflow to not have > the security risk, but its a holiday here. Can it wait? >=20 > On Fri, Jul 3, 2026 at 4:08=E2=80=AFAM Alan Woodward = <[email protected]> wrote: >>=20 >> Hi all, >>=20 >> Our Verify Change Log action in GitHub is failing on every PR now = with a permissions error: >>=20 >> "Error: Refusing to check out fork pull request code from a = 'pull_request_target' workflow. This workflow runs with the base = repository's GITHUB_TOKEN, secrets, default-branch cache scope, and = runner access. Fetching and executing a fork's code in that trusted = context commonly leads to "pwn request" vulnerabilities. To opt in, = review the risks at https://gh.io/securely-using-pull_request_target and = set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.=E2=80=9D= >>=20 >> I don=E2=80=99t know enough about how actions work to know if = changing `allow-unsafe-pr-checkout` is the right solution here, or if we = need to change the access for this action somehow? >>=20 >> - Alan >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >>=20 >=20 > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] >=20 --Apple-Mail=_418F8B51-4573-4ED1-A29C-BD23203BA7BC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dutf-8"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;">See Solr's <a = href=3D"https://github.com/apache/solr/tree/main/.github/workflows">renova= te-changelog-* workflows </a>which safely write to a fork's PR = branch. We recently converted it from a single pull_request_target = workflow to this two-stage approach to avoid the security = risk.<div><br></div><div>Jan<br><div><div><br><blockquote = type=3D"cite"><div>3. juli 2026 kl. 14:20 skrev Robert Muir = <[email protected]>:</div><br = class=3D"Apple-interchange-newline"><div><div>I was worried this would = find something when upgrading to<br>actions/checkout version. I'd like = to change this workflow to not have<br>the security risk, but its a = holiday here. Can it wait?<br><br>On Fri, Jul 3, 2026 at 4:08=E2=80=AFAM = Alan Woodward <[email protected]> wrote:<br><blockquote = type=3D"cite"><br>Hi all,<br><br>Our Verify Change Log action in GitHub = is failing on every PR now with a permissions error:<br><br>"Error: = Refusing to check out fork pull request code from a = 'pull_request_target' workflow. This workflow runs with the base = repository's GITHUB_TOKEN, secrets, default-branch cache scope, and = runner access. Fetching and executing a fork's code in that trusted = context commonly leads to "pwn request" vulnerabilities. To opt in, = review the risks at https://gh.io/securely-using-pull_request_target and = set 'allow-unsafe-pr-checkout: true' on the actions/checkout = step.=E2=80=9D<br><br>I don=E2=80=99t know enough about how actions work = to know if changing `allow-unsafe-pr-checkout` is the right solution = here, or if we need to change the access for this action = somehow?<br><br>- = Alan<br>------------------------------------------------------------------= ---<br>To unsubscribe, e-mail: [email protected]<br>For = additional commands, e-mail: = [email protected]<br><br></blockquote><br>-----------------------= ----------------------------------------------<br>To unsubscribe, = e-mail: [email protected]<br>For additional commands, = e-mail: = [email protected]<br><br></div></div></blockquote></div><br></div= ></div></body></html>= --Apple-Mail=_418F8B51-4573-4ED1-A29C-BD23203BA7BC--