Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Fix docs builds that run on PRs from forks - #1101

Merged
ofek merged 1 commit into
mainfrom
fix-docs-on-forks
Jun 27, 2026
Merged

Fix docs builds that run on PRs from forks#1101
ofek merged 1 commit into
mainfrom
fix-docs-on-forks

Conversation

@ofek

@ofek ofek commented Jun 27, 2026

Copy link
Copy Markdown
Member

https://github.com/msgspec/msgspec/actions/runs/28223897460/job/83611202184

Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

Copilot opened #1100 but I very much dislike the workflow_run trigger because the status does not get reflected on the PR. Therefore, either failures go unnoticed or there has to be a job that manually updates the PR's commit status (and if something goes wrong then we're back to failures going unnoticed).

@ofek
ofek marked this pull request as ready for review June 27, 2026 06:13
@ofek
ofek requested a review from a team June 27, 2026 06:13
@ofek
ofek merged commit 9fe8451 into main Jun 27, 2026
26 checks passed
@ofek
ofek deleted the fix-docs-on-forks branch June 27, 2026 06:14
@sobolevn

Copy link
Copy Markdown
Member

@ofek

ofek commented Jun 27, 2026

Copy link
Copy Markdown
Member Author

Try again #1102

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants