anton-vinogradov opened a new pull request, #13390: URL: https://github.com/apache/ignite/pull/13390
### Problem Since the GitHub runner image update (~2026-07-14), `actions/checkout@v4` by default refuses to check out fork PR code in workflows triggered by `pull_request_target` (new "pwn request" protection) and fails with: > Refusing to check out fork pull request code from a 'pull_request_target' workflow. ... To opt in ... set 'allow-unsafe-pr-checkout: true' on the actions/checkout step. As a result, all 5 commit-check jobs (Check java code on JDK 17, Check .NET code, Check ducktape on codestyle/py38/py39) fail at the checkout step for every fork PR. ### Fix Add `allow-unsafe-pr-checkout: true` to each `actions/checkout` step that checks out `github.event.pull_request.head.sha`. The workflow uses `pull_request_target` deliberately (see the comment in the file: the checks must also run for PRs that conflict with the base branch) and is already hardened for running untrusted PR code, as recommended in https://gh.io/securely-using-pull_request_target: - the workflow token is read-only (`permissions: contents: read`); - the workflow exposes no secrets, and the file documents that none may be added. So the opt-in flag only acknowledges a risk that is already consciously accepted and documented in the workflow itself, and restores the pre-update behavior. ### Note on verification For `pull_request_target` events GitHub runs the workflow definition from the **base** branch, so the commit checks of this very PR still run the unfixed file and fail at checkout (demonstrating the bug). The fix takes effect for all fork PRs once merged to master. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
