From dd537806bfe63ab76ccfe7c4bbb46dad4dec190c Mon Sep 17 00:00:00 2001
From: PastaClaw <thepastaclaw@users.noreply.github.com>
Date: Tue, 21 Jul 2026 12:58:48 -0500
Subject: [PATCH] fix(ci): allow checkout v6 for PR heads

Explicitly allow the 11 pull_request_target checkout steps that intentionally check out fork head SHAs under checkout v6.1. Disable credential persistence for the same untrusted working trees while preserving the existing runner, cache, container, permission, and Guix behavior.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/build-container.yml       | 6 ++++++
 .github/workflows/build-depends.yml         | 4 ++++
 .github/workflows/build-src.yml             | 2 ++
 .github/workflows/cache-depends-sources.yml | 2 ++
 .github/workflows/guix-build.yml            | 4 ++++
 .github/workflows/lint.yml                  | 2 ++
 .github/workflows/test-src.yml              | 2 ++
 7 files changed, 22 insertions(+)

diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index 2da2ae152999..078a3e84a5ec 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -41,6 +41,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -85,6 +87,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -128,6 +132,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
diff --git a/.github/workflows/build-depends.yml b/.github/workflows/build-depends.yml
index 184df31176fe..07b89e270203 100644
--- a/.github/workflows/build-depends.yml
+++ b/.github/workflows/build-depends.yml
@@ -52,6 +52,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           sparse-checkout: |
             ci/dash
             ci/test
@@ -134,6 +136,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Restore depends sources
         uses: actions/cache/restore@v5
diff --git a/.github/workflows/build-src.yml b/.github/workflows/build-src.yml
index 0b5ad76c010c..8ea9ba443378 100644
--- a/.github/workflows/build-src.yml
+++ b/.github/workflows/build-src.yml
@@ -57,6 +57,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup
diff --git a/.github/workflows/cache-depends-sources.yml b/.github/workflows/cache-depends-sources.yml
index 60dfa4457ab1..122851d8cd72 100644
--- a/.github/workflows/cache-depends-sources.yml
+++ b/.github/workflows/cache-depends-sources.yml
@@ -23,6 +23,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Check for cached sources
         id: cache-check
diff --git a/.github/workflows/guix-build.yml b/.github/workflows/guix-build.yml
index 5c3bc61d39c9..98ecc74afe9e 100644
--- a/.github/workflows/guix-build.yml
+++ b/.github/workflows/guix-build.yml
@@ -28,6 +28,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 
@@ -87,6 +89,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a411130eb42c..b936e2657c78 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,6 +24,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup
diff --git a/.github/workflows/test-src.yml b/.github/workflows/test-src.yml
index 0f6e22ec0b0d..f27751be60a2 100644
--- a/.github/workflows/test-src.yml
+++ b/.github/workflows/test-src.yml
@@ -36,6 +36,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 1
 
       - name: Download build artifacts