You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lucene.apache.org by Alan Woodward <ro...@gmail.com> on 2026/07/03 08:08:22 UTC
Verify Change Log action failing
Hi all,
Our Verify Change Log action in GitHub is failing on every PR now with a permissions error:
"Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.”
I don’t know enough about how actions work to know if changing `allow-unsafe-pr-checkout` is the right solution here, or if we need to change the access for this action somehow?
- Alan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org
Re: Verify Change Log action failing
Posted by Alan Woodward <ro...@gmail.com>.
Thanks Jan, that looks very helpful. All fine to wait until after the holidays are done. Enjoy your 4th July beers Robert :)
> On 3 Jul 2026, at 23:35, Jan Høydahl <ja...@cominvent.com> wrote:
>
> See Solr's renovate-changelog-* workflows <https://github.com/apache/solr/tree/main/.github/workflows>which safely write to a fork's PR branch. We recently converted it from a single pull_request_target workflow to this two-stage approach to avoid the security risk.
>
> Jan
>
>> 3. juli 2026 kl. 14:20 skrev Robert Muir <rc...@gmail.com>:
>>
>> I was worried this would find something when upgrading to
>> actions/checkout version. I'd like to change this workflow to not have
>> the security risk, but its a holiday here. Can it wait?
>>
>> On Fri, Jul 3, 2026 at 4:08 AM Alan Woodward <ro...@gmail.com> wrote:
>>>
>>> Hi all,
>>>
>>> Our Verify Change Log action in GitHub is failing on every PR now with a permissions error:
>>>
>>> "Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.”
>>>
>>> I don’t know enough about how actions work to know if changing `allow-unsafe-pr-checkout` is the right solution here, or if we need to change the access for this action somehow?
>>>
>>> - Alan
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
>>> For additional commands, e-mail: dev-help@lucene.apache.org
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
>> For additional commands, e-mail: dev-help@lucene.apache.org
>>
>
Re: Verify Change Log action failing
Posted by Dawid Weiss <da...@gmail.com>.
> See Solr's renovate-changelog-* workflows
> <https://github.com/apache/solr/tree/main/.github/workflows>which safely
> write to a fork's PR branch. We recently converted it from a single
> pull_request_target workflow to this two-stage approach to avoid the
> security risk.
This is far from trivial though? Requires a separate github account and a
pat token with permissions. I'll just turn off this workflow for now
because it makes life unbearable.
Dawid
Re: Verify Change Log action failing
Posted by Jan Høydahl <ja...@cominvent.com>.
See Solr's renovate-changelog-* workflows <https://github.com/apache/solr/tree/main/.github/workflows>which safely write to a fork's PR branch. We recently converted it from a single pull_request_target workflow to this two-stage approach to avoid the security risk.
Jan
> 3. juli 2026 kl. 14:20 skrev Robert Muir <rc...@gmail.com>:
>
> I was worried this would find something when upgrading to
> actions/checkout version. I'd like to change this workflow to not have
> the security risk, but its a holiday here. Can it wait?
>
> On Fri, Jul 3, 2026 at 4:08 AM Alan Woodward <ro...@gmail.com> wrote:
>>
>> Hi all,
>>
>> Our Verify Change Log action in GitHub is failing on every PR now with a permissions error:
>>
>> "Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.”
>>
>> I don’t know enough about how actions work to know if changing `allow-unsafe-pr-checkout` is the right solution here, or if we need to change the access for this action somehow?
>>
>> - Alan
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
>> For additional commands, e-mail: dev-help@lucene.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
> For additional commands, e-mail: dev-help@lucene.apache.org
>
Re: Verify Change Log action failing
Posted by Robert Muir <rc...@gmail.com>.
I was worried this would find something when upgrading to
actions/checkout version. I'd like to change this workflow to not have
the security risk, but its a holiday here. Can it wait?
On Fri, Jul 3, 2026 at 4:08 AM Alan Woodward <ro...@gmail.com> wrote:
>
> Hi all,
>
> Our Verify Change Log action in GitHub is failing on every PR now with a permissions error:
>
> "Error: Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.”
>
> I don’t know enough about how actions work to know if changing `allow-unsafe-pr-checkout` is the right solution here, or if we need to change the access for this action somehow?
>
> - Alan
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
> For additional commands, e-mail: dev-help@lucene.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org