hello-stephen opened a new pull request, #65833: URL: https://github.com/apache/doris/pull/65833
### What problem does this PR solve? GitHub now blocks `actions/checkout` from checking out fork PR code in a `pull_request_target` workflow by default. As a result, License Check and the `pull_request_target` instance of Code Formatter fail during checkout before their actual checks run. Example failure: https://github.com/apache/doris/actions/runs/29789987113/job/88526293992?pr=64849 GitHub announcement: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ ### What changed? - Run License Check for PRs with the unprivileged `pull_request` event. - Keep the incremental license configuration generation for PR files. - Remove the duplicate `pull_request_target` trigger and checkout path from Code Formatter. - Restrict License Check permissions to read-only access. - Upgrade both checkout steps from `actions/checkout@v3` to `actions/checkout@v7`. Push, workflow dispatch, and `run buildall` issue-comment behavior remain unchanged. ### Check List - `actionlint .github/workflows/license-eyes.yml .github/workflows/clang-format.yml` - `git diff --check` ### Validation note Before this PR is merged, GitHub still loads the `pull_request_target` definitions from the default branch. Therefore this PR's old License Check, and potentially the duplicate target-side Code Formatter run, are expected to fail at checkout with the same security rejection. New PR runs will use the safe `pull_request` definitions after this change reaches `master`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
