Stop privileged workflows from checking out artifact-selected SHAs

[etsauer]

• I have read Pelorus Contributing guidelines

Linked Issues

related to Red Hat PSIRTSUPT-22553 / BOOST-VPD-2026-044

Description

Privileged workflow_run jobs in test-images.yml and integration-tests.yml checked out whatever SHA the untrusted producer artifact supplied as branch_ref. A fork pull request can put a different fork-network commit in that artifact and bypass actions/checkout's unsafe-checkout guard, then run with Quay and other secrets.

These consumers now check out github.event.workflow_run.head_sha, skip unless the triggering repository is this repo, and disable persisted git credentials after checkout.

Testing Instructions

• Confirm same-repo PRs and pushes that trigger Trigger test images still run Test images manager and Integration Tests, and that checkout uses the workflow_run head SHA (not branch_ref from the artifact).
• Confirm a fork PR no longer reaches the privileged create-images / integration-test jobs (job skipped by the head_repository condition).
• Follow the standard PR testing process as applicable; these files are GitHub Actions workflows and are not covered by in-repo unit tests.

Made with Cursor

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[etsauer]

Closing: this targeted the wrong upstream. The fix is in dora-metrics#1248