ci(nixos): allow fork PR checkout under pull_request_target (+ ARM-primary)#545
Merged
Conversation
…mary actions/checkout now refuses to check out a fork PR's head under pull_request_target unless allow-unsafe-pr-checkout is set, so every testable fork PR (e.g. the Asteroids PR) fails at checkout before building. Add the opt-in on the two head-checkout steps only; the trusted update-manifest checkout is left untouched. Also flips the build to the free ubuntu-24.04-arm hosted runner first, with the self-hosted Pi5 as last-resort fallback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Testable fork PRs (e.g. #534 "Asteroids!", from
mrosseel:feature/observable-asteroids) fail immediately at checkout:actions/checkoutrecently began refusing to check out a fork PR's head when the trigger ispull_request_target. Becausepull_request_targetruns the base repo's default-branch copy of the workflow, this can only be fixed here onrelease— a contributor's fork branch can't change it. Same-repo PRs are unaffected, which is why it only bites fork PRs.Fix
allow-unsafe-pr-checkout: trueto the two head-checkout steps only (build-hosted,build-pi5). The trustedupdate-manifestcheckout (base branch, holds the write token) is left untouched.testable/previewlabel (the existing review gate for running contributor code) and checks out a pinned head SHA.ubuntu-24.04-armhosted runner, with the self-hosted Pi5 demoted to a last-resort fallback (matches theci-nixos-arm-primarychange).Effect
Once merged into
release, re-triggering a labeled fork PR (toggle itstestablelabel) builds on GitHub's ARM runner instead of dying at checkout.