From d79f081f3fa148afa2b52e85aba42dc2b5ade20a Mon Sep 17 00:00:00 2001 From: Ralph Bean Date: Mon, 22 Jun 2026 10:09:19 -0400 Subject: [PATCH] fix(#2504): allow checkout@v7 to check out fork PR code in e2e workflow checkout@v7 added a safety check that blocks fork PR checkouts in pull_request_target workflows by default. The e2e workflow's gate job already requires the ok-to-test label from a maintainer before the e2e job runs, so opting in with allow-unsafe-pr-checkout is safe here. Assisted-by: Claude Opus 4.6 Signed-off-by: Ralph Bean --- .github/workflows/e2e.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 55ac425d4..8a6b17911 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -107,6 +107,7 @@ jobs: with: ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} persist-credentials: false + allow-unsafe-pr-checkout: true # Safe: gate job requires ok-to-test label from maintainer before this runs - uses: actions/setup-go@v6 if: steps.changes.outputs.relevant != 'false'