From a9115715f887c6d689991da906a4ec7a16911124 Mon Sep 17 00:00:00 2001 From: HeavyGee <133152184+heavygee@users.noreply.github.com> Date: Wed, 22 Jul 2026 02:19:17 +0100 Subject: [PATCH] fix(ci): opt in fork PR checkout for Codex review (#1107) GitHub's 2026-07-20 actions/checkout backport refuses fork PR refs under pull_request_target unless allow-unsafe-pr-checkout is set. HAPI Bot needs the merge ref plus base-repo secrets; this restores fork contributor reviews. Co-authored-by: Debian Co-authored-by: Cursor --- .github/workflows/codex-pr-review.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml index 90be87f8..c31c7562 100644 --- a/.github/workflows/codex-pr-review.yml +++ b/.github/workflows/codex-pr-review.yml @@ -85,12 +85,16 @@ jobs: env: HAPI_BOT_LOGINS: ${{ vars.HAPI_BOT_LOGINS }} + # Codex reviews the PR merge ref under pull_request_target (needs base-repo + # secrets). GitHub's 2026-07-20 checkout backport refuses fork PR checkouts + # here unless explicitly opted in: https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ - name: Checkout repository if: steps.check_bot.outputs.has_review_for_current_head != 'true' uses: actions/checkout@v4 with: ref: refs/pull/${{ github.event.pull_request.number }}/merge fetch-depth: 0 + allow-unsafe-pr-checkout: true - name: Pre-fetch base and head refs if: steps.check_bot.outputs.has_review_for_current_head != 'true'