ci: allow merged fork subject checkout

.github/actionlint.yaml

@@ -33,6 +33,10 @@ paths:
   .github/workflows/e2e-upgrade.yaml:
     ignore:
       - 'constant expression "false" in condition'
+  .github/workflows/merge-trigger-tke.yaml:
+    ignore:
+      # actionlint v1.7.12 predates this input's backport to checkout v6.
+      - 'input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v6"'
   .github/workflows/robot.yaml:
     ignore:
       # Existing legacy workflow; keep new changes clean without broadening

.github/workflows/merge-trigger-tke.yaml

@@ -50,6 +50,9 @@ jobs:
           # branch. A merged release-branch PR must build its exact immutable
           # merge result, not whichever main commit is current at dispatch.
           ref: ${{ github.event.pull_request.merge_commit_sha }}
+          # This job only runs after the PR is merged, so this SHA is already
+          # part of the trusted base repository rather than an unmerged fork head.
+          allow-unsafe-pr-checkout: true
       - name: Verify exact merged MatrixOne subject
         id: subject
         env:
@@ -279,6 +282,7 @@ jobs:
           token: ${{ secrets.TOKEN_ACTION }}
           path: ./matrixone
           ref: ${{ needs.docker_image_build.outputs.full_commit_id }}
+          allow-unsafe-pr-checkout: true
       - name: Clean TKE ENV
         run: |
           if [ "$(kubectl -n mo-checkin-regression-${{ github.event.pull_request.number }} get mo | grep -c "mo-checkin-regression")" -ne 0 ];then 
@@ -451,6 +455,7 @@ jobs:
           token: ${{ secrets.TOKEN_ACTION }}
           path: ./matrixone
           ref: ${{ needs.docker_image_build.outputs.full_commit_id }}
+          allow-unsafe-pr-checkout: true
       - name: Set JAVA PATH
         run: |
           echo "$JAVA_HOME/bin" >> $GITHUB_PATH

scripts/test_merge_trigger_tke_subject.py

@@ -11,7 +11,10 @@
 def validate_subject_contract(source: str) -> None:
     merge_sha = "${{ github.event.pull_request.merge_commit_sha }}"
     verified_sha = "${{ needs.docker_image_build.outputs.full_commit_id }}"
+    unsafe_checkout_opt_in = "allow-unsafe-pr-checkout: true"
 
+    if "if: ${{ github.event.pull_request.merged == true }}" not in source:
+        raise AssertionError("image build is not restricted to merged pull requests")
     if "full_commit_id: ${{ steps.subject.outputs.commit_id }}" not in source:
         raise AssertionError("build job does not publish its verified full commit")
     if f"ref: {merge_sha}" not in source:
@@ -30,6 +33,10 @@ def validate_subject_contract(source: str) -> None:
         raise AssertionError("unexpected MatrixOne checkout inventory")
     if source.count(f"ref: {verified_sha}") != 2:
         raise AssertionError("Setup and BVT are not both bound to the built SHA")
+    if source.count(unsafe_checkout_opt_in) != 3:
+        raise AssertionError(
+            "exact MatrixOne checkouts must be the only unsafe checkout opt-ins"
+        )
 
     # Both CN resource checkouts use an explicit synthetic local ref sourced
     # from the same verified SHA.
@@ -73,6 +80,24 @@ def test_default_branch_context_is_rejected(self) -> None:
         with self.assertRaisesRegex(AssertionError, "built SHA"):
             validate_subject_contract(broken)
 
+    def test_missing_fork_checkout_compatibility_is_rejected(self) -> None:
+        broken = self.source.replace(
+            "          allow-unsafe-pr-checkout: true\n",
+            "",
+            1,
+        )
+        with self.assertRaisesRegex(AssertionError, "unsafe checkout opt-ins"):
+            validate_subject_contract(broken)
+
+    def test_unmerged_pull_requests_are_rejected(self) -> None:
+        broken = self.source.replace(
+            "    if: ${{ github.event.pull_request.merged == true }}\n",
+            "",
+            1,
+        )
+        with self.assertRaisesRegex(AssertionError, "restricted to merged"):
+            validate_subject_contract(broken)
+
 
 if __name__ == "__main__":
     unittest.main()