Fix lint workflow to checkout PR branch instead of base branch#5084
Fix lint workflow to checkout PR branch instead of base branch#5084ahpook merged 2 commits intoahpook/rubocop-wtffrom
Conversation
The lint.yml workflow uses pull_request_target trigger, which causes actions/checkout to check out the base branch (main) by default. This means rubocop runs against main's code, not the PR's changes. Add ref parameter to checkout the PR's head branch, with fallback to github.ref for workflow_dispatch and merge_group triggers. Co-authored-by: ahpook <56753+ahpook@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/explore/sessions/f08905db-e076-48a4-8c19-6b4acc2c537c
There was a problem hiding this comment.
Pull request overview
Updates the lint GitHub Actions workflow so that, when triggered via pull_request_target, it checks out the PR’s head branch rather than the base branch—ensuring RuboCop runs against the proposed changes and can auto-correct them on the PR branch.
Changes:
- Add an explicit
reftoactions/checkoutto prefergithub.event.pull_request.head.refwith a fallback togithub.ref.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: actions/checkout@v6.0.1 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.ref || github.ref }} |
There was a problem hiding this comment.
Checking out the PR head branch under pull_request_target while the workflow has contents: write and runs Bundler/RuboCop means untrusted PR code can execute with a write-capable GITHUB_TOKEN (repo-compromise risk). It will also fail for fork PRs because head.ref refers to a branch in the fork, but actions/checkout defaults to the base repo unless repository: is set.
Consider gating this job/step to same-repo PRs only (e.g., if: github.event.pull_request.head.repo.full_name == github.repository) and using a separate read-only lint workflow for forks; or otherwise avoid pull_request_target + write permissions when running PR code.
The
lint.ymlworkflow usespull_request_target, which causesactions/checkoutto check out the base branch (main) by default—not the PR branch. Rubocop then lintsmain, misses PR fixes, and fails on already-resolved issues.Change
Added explicit
refto the checkout step:pull_request_target→ checks out the PR's head branchworkflow_dispatch/merge_group→ falls back togithub.ref(default behavior)Uses
head.ref(branch name) rather thanhead.shabecause the workflow pushes auto-corrected commits back to the PR branch, which requires a named ref.⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.