fix(ci): allow showtime to check out fork PR code under checkout v7 - #41643
Merged
Conversation
actions/checkout v7.0.0 (#41358) refuses to check out fork PR code from a pull_request_target workflow unless the step sets allow-unsafe-pr-checkout: true, which broke every showtime launch on fork PRs. The checkout is already gated behind the maintainer-authorization step (write/admin actors only) and uses persist-credentials: false, so opt in explicitly and fix the stale zizmor comment that claimed the workflow never checks out PR code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
the
github_actions
sadpandajoe
added
the
🎪 ⚡ showtime-trigger-start
github-actions
Bot
added
🎪 55bf380 🚦 building
🎪 ⌛ 48h
Contributor
Contributor
|
🎪 Showtime deployed environment on GHA for 55bf380 • Environment: http://54.218.247.178:8080 (admin/admin) |
sadpandajoe
marked this pull request as ready for review
July 2, 2026 17:19
sadpandajoe
requested review from
betodealmeida,
eschutho,
geido,
kgabryje,
mistercrunch,
nytai,
rusackas,
sha174n and
villebro
as code owners
July 2, 2026 17:19
hainenber
approved these changes
Jul 2, 2026
github-actions
Bot
removed
🎪 ⌛ 48h
Contributor
|
Bito Automatic Review Skipped – PR Already Merged |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Showtime ephemeral-environment launches fail on every fork PR since #41358 bumped
actions/checkoutfrom 6.0.3 to 7.0.0. checkout v7 introduced a safety guard that refuses to fetch fork-PR code inside apull_request_targetworkflow unless the step explicitly opts in, so the "🎪 Sync PR to desired state" job now dies at the checkout step with:Checking out and building fork PR code is Showtime's entire purpose, and the checkout step is already gated behind the maintainer-authorization step (only actors with
write/adminpermission pass) and usespersist-credentials: false. This PR setsallow-unsafe-pr-checkout: trueon that step — the opt-in the guard itself prescribes — and fixes the stale zizmor comment at the top of the workflow, which claimed the workflow never checks out PR-provided code.The other
pull_request_targetworkflows (labeler.yml,welcome-new-users.yml) have no checkout step, and theworkflow_rundocs workflows either restrict to same-repo heads or run on push, so this is the only workflow affected by the v7 guard.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A (CI workflow change)
TESTING INSTRUCTIONS
showtime-trigger-startlabel to a fork PR (e.g. re-trigger on fix(explore): restore drag-and-drop reordering broken by @dnd-kit migration #41637, where the failure was observed: run 28544444889).Pre-commit (
check yaml,zizmorGHA security audit) passes on the changed file.ADDITIONAL INFORMATION
🤖 Generated with Claude Code