ci: opt in to allow-unsafe-pr-checkout for fork PR warehouse tests - #2324
ci: opt in to allow-unsafe-pr-checkout for fork PR warehouse tests#2324haritamar wants to merge 2 commits into
Conversation
Co-Authored-By: Itamar Hartstein <haritamar@gmail.com>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
👋 @haritamar |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe warehouse test workflow updates Elementary checkout controls for fork pull requests and disables persisted Git credentials for both the Elementary and dbt package checkouts. ChangesWarehouse test workflow
Estimated code review effort: 2 (Simple) | ~5 minutes Mergeability Score: 🟠 High · up to This change allows fork pull request code to run in privileged warehouse-test jobs with access to sensitive credentials and cloud permissions. A malicious fork could potentially misuse those permissions, so the PR should not merge until that security exposure is mitigated or explicitly accepted by the appropriate owner. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Co-Authored-By: Itamar Hartstein <haritamar@gmail.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test-warehouse.yml:
- Line 107: Update the actionlint metadata or upgrade actionlint so it
recognizes the allow-unsafe-pr-checkout input used with actions/checkout@v6.
Preserve the existing allow-unsafe-pr-checkout configuration and align the
linter’s action metadata with the checkout version used by CI.
- Around line 100-107: Update the Checkout Elementary and Checkout dbt package
action steps to set persist-credentials to false, preventing either checkout
from leaving the base GITHUB_TOKEN available to fork-controlled code. Keep the
existing checkout configuration and allow-unsafe-pr-checkout behavior unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1cc91ac5-f01e-4155-b0b9-00c567eebe5f
📒 Files selected for processing (1)
.github/workflows/test-warehouse.yml
| # elementary_test_env environment, so a maintainer must approve the | ||
| # run before this fork code is checked out and executed, and only an | ||
| # explicit allowlist of secrets is passed in. | ||
| allow-unsafe-pr-checkout: true |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml |
grep -A8 '^allow-unsafe-pr-checkout:'
actionlint .github/workflows/test-warehouse.ymlRepository: elementary-data/elementary
Length of output: 164
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- workflow context ---'
sed -n '85,120p' .github/workflows/test-warehouse.yml
printf '%s\n' '--- checkout references ---'
rg -n -C 2 'actions/checkout|allow-unsafe-pr-checkout|actionlint' .github . 2>/dev/null | head -200
printf '%s\n' '--- actionlint availability ---'
if command -v actionlint >/dev/null 2>&1; then
actionlint --version
actionlint .github/workflows/test-warehouse.yml
printf 'actionlint_exit=%s\n' "$?"
else
printf '%s\n' 'actionlint: not installed'
fi
printf '%s\n' '--- checkout v6 metadata ---'
if command -v curl >/dev/null 2>&1; then
curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml | \
awk '/^[[:space:]]*allow-unsafe-pr-checkout:/,/^[[:space:]]*[A-Za-z0-9_-]+:/{print}' | head -10
printf 'curl_exit=%s\n' "$?"
else
printf '%s\n' 'curl: not installed'
fiRepository: elementary-data/elementary
Length of output: 8102
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- actionlint references and configuration ---'
rg -n -C 3 'actionlint|reviewdog|rhysd|workflow-files|actions/checkout' \
.github Makefile* justfile* Taskfile* package.json pyproject.toml .pre-commit-config.yaml 2>/dev/null | head -300
printf '%s\n' '--- actionlint help and embedded metadata clues ---'
actionlint -help 2>&1 | head -120
printf '%s\n' '--- checkout v6 metadata ---'
curl -fsSL https://raw.githubusercontent.com/actions/checkout/v6/action.yml | \
sed -n '/allow-unsafe-pr-checkout/,+8p'
printf '%s\n' '--- checkout v6 ref resolution ---'
curl -fsSL https://api.github.com/repos/actions/checkout/git/ref/tags/v6 \
-H 'Accept: application/vnd.github+json' | jq '{ref, object}'
curl -fsSL https://api.github.com/repos/actions/checkout/releases/tags/v6.1.0 \
-H 'Accept: application/vnd.github+json' | jq '{tag_name, published_at, target_commitish, body}'
printf '%s\n' '--- actionlint releases ---'
curl -fsSL https://api.github.com/repos/rhysd/actionlint/releases/tags/1.7.12 \
-H 'Accept: application/vnd.github+json' | jq '{tag_name, published_at, target_commitish, body}'Repository: elementary-data/elementary
Length of output: 10422
Update actionlint metadata or upgrade actionlint.
actions/checkout@v6 defines allow-unsafe-pr-checkout, but actionlint 1.7.12 does not recognize it. Keep the input and align the linter metadata with the action version used by CI.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 107-107: input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v6". available inputs are "clean", "fetch-depth", "fetch-tags", "filter", "github-server-url", "lfs", "path", "persist-credentials", "ref", "repository", "set-safe-directory", "show-progress", "sparse-checkout", "sparse-checkout-cone-mode", "ssh-key", "ssh-known-hosts", "ssh-strict", "ssh-user", "submodules", "token"
(action)
🪛 zizmor (1.29.0)
[warning] 95-107: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test-warehouse.yml at line 107, Update the actionlint
metadata or upgrade actionlint so it recognizes the allow-unsafe-pr-checkout
input used with actions/checkout@v6. Preserve the existing
allow-unsafe-pr-checkout configuration and align the linter’s action metadata
with the checkout version used by CI.
Source: Linters/SAST tools
There was a problem hiding this comment.
Not actionable here: this repo doesn't run actionlint in CI or pre-commit, so there's no metadata to align or version to bump — the diagnostic is from CodeRabbit's own actionlint 1.7.12, which predates allow-unsafe-pr-checkout (added in actions/checkout v6.1.0). Keeping the input.
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
1 participant
Summary
actions/checkoutnow refuses to check out fork PR code underpull_request_targetunlessallow-unsafe-pr-checkout: trueis set, which broke all warehouse test jobs (e.g. this run):Our
pull_request_targetusage here is intentional: integration tests need the CI secrets of our test warehouses, which a fork'spull_requestrun cannot access.test-all-warehouses.ymlgates fork PRs behind theelementary_test_envenvironment (approve-forkjob), so a maintainer must approve before the fork code is checked out, and only an explicit allowlist of secrets is forwarded totest-warehouse.yml.So the checkout of the PR head opts in explicitly, with a comment recording the above rationale.
Link to Devin session: https://app.devin.ai/sessions/9cfcaa3435b64897992abc30956db12a
Requested by: @haritamar
Summary by CodeRabbit