From e408c3a926c449f120e7911915e744732c414e8c Mon Sep 17 00:00:00 2001 From: Lasse Benninga Date: Fri, 24 Jul 2026 10:45:58 +0200 Subject: [PATCH] fix(auto-grade): allow fork PR checkout under pull_request_target actions/checkout v6+ refuses to check out fork heads in pull_request_target workflows unless allow-unsafe-pr-checkout is set. HYF assignment graders need that opt-in to run .hyf/test.sh on student forks and post the score comment. Pin the head repo explicitly and drop persisted credentials from the student tree. Co-authored-by: Cursor --- .github/workflows/auto-grade.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-grade.yml b/.github/workflows/auto-grade.yml index 75ae20f..e9446b9 100644 --- a/.github/workflows/auto-grade.yml +++ b/.github/workflows/auto-grade.yml @@ -17,12 +17,21 @@ jobs: issues: write steps: - # Checkout the trainee's assignment code + # Checkout the trainee's assignment code (fork PR head). + # pull_request_target is required so we can comment scores on fork PRs. + # actions/checkout v6+ refuses fork checkouts here unless we opt in. + # We intentionally execute the student's .hyf/test.sh next; keep the + # GITHUB_TOKEN least-privilege (contents:read, no extra secrets) and + # do not persist credentials into the student tree. + # See https://gh.io/securely-using-pull_request_target - name: Checkout assignment code uses: actions/checkout@v6 with: + repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.event.pull_request.head.sha }} path: assignment + persist-credentials: false + allow-unsafe-pr-checkout: true # Checkout the grading workflow scripts - name: Checkout workflow scripts