From d993817cd39a10ed1ae2412c48dbcbc1b243e3f5 Mon Sep 17 00:00:00 2001
From: "Ariznawl@163.com" <ariznawl@163.com>
Date: Wed, 2 Sep 2026 15:40:01 +0800
Subject: [PATCH 1/2] ci: allow merged fork subject checkout

---
 .github/workflows/merge-trigger-tke.yaml  |  5 +++++
 scripts/test_merge_trigger_tke_subject.py | 25 +++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/.github/workflows/merge-trigger-tke.yaml b/.github/workflows/merge-trigger-tke.yaml
index 0ea6061..2b0d89f 100644
--- a/.github/workflows/merge-trigger-tke.yaml
+++ b/.github/workflows/merge-trigger-tke.yaml
@@ -50,6 +50,9 @@ jobs:
           # branch. A merged release-branch PR must build its exact immutable
           # merge result, not whichever main commit is current at dispatch.
           ref: ${{ github.event.pull_request.merge_commit_sha }}
+          # This job only runs after the PR is merged, so this SHA is already
+          # part of the trusted base repository rather than an unmerged fork head.
+          allow-unsafe-pr-checkout: true
       - name: Verify exact merged MatrixOne subject
         id: subject
         env:
@@ -279,6 +282,7 @@ jobs:
           token: ${{ secrets.TOKEN_ACTION }}
           path: ./matrixone
           ref: ${{ needs.docker_image_build.outputs.full_commit_id }}
+          allow-unsafe-pr-checkout: true
       - name: Clean TKE ENV
         run: |
           if [ "$(kubectl -n mo-checkin-regression-${{ github.event.pull_request.number }} get mo | grep -c "mo-checkin-regression")" -ne 0 ];then 
@@ -451,6 +455,7 @@ jobs:
           token: ${{ secrets.TOKEN_ACTION }}
           path: ./matrixone
           ref: ${{ needs.docker_image_build.outputs.full_commit_id }}
+          allow-unsafe-pr-checkout: true
       - name: Set JAVA PATH
         run: |
           echo "$JAVA_HOME/bin" >> $GITHUB_PATH
diff --git a/scripts/test_merge_trigger_tke_subject.py b/scripts/test_merge_trigger_tke_subject.py
index 515b9d3..586e25b 100644
--- a/scripts/test_merge_trigger_tke_subject.py
+++ b/scripts/test_merge_trigger_tke_subject.py
@@ -11,7 +11,10 @@
 def validate_subject_contract(source: str) -> None:
     merge_sha = "${{ github.event.pull_request.merge_commit_sha }}"
     verified_sha = "${{ needs.docker_image_build.outputs.full_commit_id }}"
+    unsafe_checkout_opt_in = "allow-unsafe-pr-checkout: true"
 
+    if "if: ${{ github.event.pull_request.merged == true }}" not in source:
+        raise AssertionError("image build is not restricted to merged pull requests")
     if "full_commit_id: ${{ steps.subject.outputs.commit_id }}" not in source:
         raise AssertionError("build job does not publish its verified full commit")
     if f"ref: {merge_sha}" not in source:
@@ -30,6 +33,10 @@ def validate_subject_contract(source: str) -> None:
         raise AssertionError("unexpected MatrixOne checkout inventory")
     if source.count(f"ref: {verified_sha}") != 2:
         raise AssertionError("Setup and BVT are not both bound to the built SHA")
+    if source.count(unsafe_checkout_opt_in) != 3:
+        raise AssertionError(
+            "exact MatrixOne checkouts must be the only unsafe checkout opt-ins"
+        )
 
     # Both CN resource checkouts use an explicit synthetic local ref sourced
     # from the same verified SHA.
@@ -73,6 +80,24 @@ def test_default_branch_context_is_rejected(self) -> None:
         with self.assertRaisesRegex(AssertionError, "built SHA"):
             validate_subject_contract(broken)
 
+    def test_missing_fork_checkout_compatibility_is_rejected(self) -> None:
+        broken = self.source.replace(
+            "          allow-unsafe-pr-checkout: true\n",
+            "",
+            1,
+        )
+        with self.assertRaisesRegex(AssertionError, "unsafe checkout opt-ins"):
+            validate_subject_contract(broken)
+
+    def test_unmerged_pull_requests_are_rejected(self) -> None:
+        broken = self.source.replace(
+            "    if: ${{ github.event.pull_request.merged == true }}\n",
+            "",
+            1,
+        )
+        with self.assertRaisesRegex(AssertionError, "restricted to merged"):
+            validate_subject_contract(broken)
+
 
 if __name__ == "__main__":
     unittest.main()

From 3dc1e162164894bdcef48057defc37059197fddc Mon Sep 17 00:00:00 2001
From: "Ariznawl@163.com" <ariznawl@163.com>
Date: Wed, 2 Sep 2026 15:59:38 +0800
Subject: [PATCH 2/2] ci: teach actionlint about checkout fork opt-in

---
 .github/actionlint.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 5e38f26..81b9941 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -33,6 +33,10 @@ paths:
   .github/workflows/e2e-upgrade.yaml:
     ignore:
       - 'constant expression "false" in condition'
+  .github/workflows/merge-trigger-tke.yaml:
+    ignore:
+      # actionlint v1.7.12 predates this input's backport to checkout v6.
+      - 'input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v6"'
   .github/workflows/robot.yaml:
     ignore:
       # Existing legacy workflow; keep new changes clean without broadening