fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump by ifireball · Pull Request #2503 · fullsend-ai/fullsend

ifireball · 2026-06-22T13:50:26Z

Summary

actions/checkout@v7 (merged in chore: update obsolete GitHub Actions to latest major versions #2457) blocks fork PR head checkouts on pull_request_target unless allow-unsafe-pr-checkout is set
Restore the e2e workflow's intentional post-gate PR head checkout, which is required for fork PRs to run e2e with secrets
No other workflows are affected: e2e is the only workflow that checks out pull_request.head.sha under pull_request_target

Context

After #2457 landed, authorized fork PRs pass the e2e gate job but fail at checkout with:

Refusing to check out fork pull request code from a 'pull_request_target' workflow

This is expected checkout@v7 behavior. The e2e split gate/e2e design already mitigates pwn-request risk: the gate job authorizes on base-branch code only, and the e2e job has no pull-requests: write.

Test plan

Open or re-run e2e on a fork PR with e2e-relevant changes; gate passes and e2e job checks out PR head successfully
Confirm push/merge_group e2e runs are unchanged (allow-unsafe-pr-checkout is false outside pull_request_target)

Made with Cursor

actions/checkout@v7 refuses fork PR head checkouts on pull_request_target unless allow-unsafe-pr-checkout is set. The e2e workflow intentionally checks out authorized PR code after the gate job; restore that behavior after the actions version bump in fullsend-ai#2457. Signed-off-by: Barak Korren <bkorren@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

qodo-code-review · 2026-06-22T13:51:22Z

PR Summary by Qodo

Fix e2e fork PR checkout under pull_request_target for actions/checkout@v7
🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

Description

• Opt into checkout@v7 unsafe PR head checkout for authorized fork PR e2e runs.
• Keep checkout safety boundaries: gate authorizes on base code; e2e job lacks PR write.
• Preserve non-PR e2e behavior by enabling the flag only for pull_request_target.

Diagram

graph TD
  A["Workflow trigger"] --> B{"pull_request_target?"} --> C["Gate job (base checkout)"] --> D["Authorize PR"] --> E["E2E job"] --> F["Checkout PR head (unsafe allowed)"] --> G["Run e2e with secrets"]
  B --> H["E2E job"] --> I["Checkout github.sha"] --> J["Run e2e"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Run e2e against PR merge ref instead of head SHA

➕ Avoids opting into unsafe head checkout under pull_request_target
➕ Tests what would be merged (closer to mainline state)
➖ May not match the workflow’s intent to test the contributor’s exact head commit
➖ Merge ref behavior can differ across repos/settings and still requires careful permissions handling

2. Build/test artifact in gate job, consume in e2e job

➕ Keeps untrusted checkout out of the secrets-bearing job entirely
➕ Clear separation between untrusted code execution and secret access
➖ Higher complexity (artifact packaging, provenance, and parity with real checkout)
➖ Harder to guarantee the artifact exactly matches what e2e expects from a full repo checkout

Recommendation: The chosen approach is appropriate given the existing split gate/e2e design: the gate job authorizes using trusted base-branch code, and the e2e job intentionally checks out PR head only after authorization and without pull-requests:write. Opting into allow-unsafe-pr-checkout solely for pull_request_target restores the previously intended behavior with minimal additional surface area.

Files changed (1) +3 / -0

Other (1) +3 / -0

e2e.ymlOpt into unsafe fork PR head checkout for e2e under pull_request_target +3/-0

Opt into unsafe fork PR head checkout for e2e under pull_request_target

• Adds allow-unsafe-pr-checkout to the actions/checkout@v7 step when running under pull_request_target. Documents why this is considered safe in this workflow due to the preceding gate authorization and restricted permissions in the e2e job.

.github/workflows/e2e.yml

github-actions · 2026-06-22T13:52:05Z

Site preview

Preview: https://029936fe-site.fullsend-ai.workers.dev

Commit: 083c6c6e3362f32112e14274b0c81a64d9252dfd

qodo-code-review · 2026-06-22T13:52:46Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

fullsend-ai-review · 2026-06-22T13:54:12Z

🤖 Finished Review · ✅ Success · Started 1:54 PM UTC · Completed 2:12 PM UTC
Commit: 083c6c6 · View workflow run →

codecov · 2026-06-22T13:58:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

ralphbean

LGTM.

fullsend-ai-review · 2026-06-22T14:12:21Z

Review

Findings

High

[protected-path] .github/workflows/e2e.yml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue documenting the breakage, impact assessment, or approval to modify CI infrastructure. While the PR description provides rationale (restoring fork PR head checkout after actions/checkout@v7 bump), protected-path changes require a linked issue for audit trail.
Remediation: File an issue documenting: (1) what broke (e2e checkout failures on fork PRs after chore: update obsolete GitHub Actions to latest major versions #2457), (2) impact scope, (3) why the fix is safe given the gate/e2e split. Link the issue to this PR.

Low

[comment-formatting] .github/workflows/e2e.yml:110 — The new comment appears inside the with: block directly above the allow-unsafe-pr-checkout parameter it describes. Other security comments in this file (lines 42–44, 71–73) appear before entire jobs, but those describe job-level concerns. Parameter-level placement is idiomatic YAML — no change needed.

Labels: PR modifies .github/workflows/e2e.yml — e2e CI workflow fix

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-06-22T14:12:22Z

        with:
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
+          # checkout@v7 blocks fork PR head checkouts on pull_request_target by default.


[low] comment-formatting

The new comment appears inside the with: block directly above the allow-unsafe-pr-checkout parameter it describes. Other security comments in this file (lines 42-44, 71-73) appear before entire jobs, but those describe job-level concerns. Parameter-level placement is idiomatic YAML — no change needed.

fullsend-ai-retro · 2026-06-22T14:31:31Z

🤖 Finished Retro · ✅ Success · Started 2:31 PM UTC · Completed 2:36 PM UTC
Commit: 083c6c6 · View workflow run →

fullsend-ai-retro · 2026-06-22T14:36:55Z

Retro: PR #2503 — `fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump`

Timeline

Time (UTC)	Event
13:50	PR opened by `ifireball` — 3-line fix to `.github/workflows/e2e.yml`
13:51–13:52	Qodo bot posts summary and review (no issues found)
13:54	Review agent posts "started" status
14:10	`ralphbean` approves with "LGTM" (before review agent finishes)
14:12	Review agent submits CHANGES_REQUESTED — HIGH [protected-path] (missing linked issue), LOW [comment-formatting] (no action needed)
14:26	PR merged despite bot's CHANGES_REQUESTED

Assessment

This workflow completed successfully with appropriate human judgment. The review agent's HIGH finding was procedural (missing linked issue for a protected path change), not technical. The human reviewer correctly assessed the 3-line fix as safe and merged it. The 18-minute review time for a 3-line diff was disproportionate but not blocking since the human approved independently.

Existing issues already cover observed patterns

The improvement opportunities from this PR are well-covered by existing open issues:

Protected-path severity for human PRs: #1551 proposes downgrading protected-path severity for human-authored PRs
Missing-authorization severity cap: #2200 proposes capping missing-authorization severity at Low when the PR body is descriptive
COMMENT verdict for human PRs: #2115 proposes using COMMENT instead of CHANGES_REQUESTED for human-authored PRs with only medium/low findings
Governance-only findings: #1068 proposes not filing CHANGES_REQUESTED for findings the fix agent cannot resolve
Fast path for trivial changes: #1900 proposes a fast review path for small diffs
PR description context: #2380 proposes fetching URLs linked in PR descriptions to validate change necessity

No new proposals are warranted — implementing the existing issues (particularly #1551, #2200, and #2115) would have prevented the false-positive CHANGES_REQUESTED on this PR.

…7-unsafe-pr-opt-in fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump

ifireball self-assigned this Jun 22, 2026

ifireball requested review from ralphbean, rh-hemartin and waynesun09 June 22, 2026 13:50

github-actions Bot deployed to site-preview June 22, 2026 13:52 View deployment

ralphbean mentioned this pull request Jun 22, 2026

fix(#2504): allow checkout@v7 to check out fork PR code in e2e workflow #2505

Closed

2 tasks

ralphbean approved these changes Jun 22, 2026

View reviewed changes

fullsend-ai-review Bot suggested changes Jun 22, 2026

View reviewed changes

fullsend-ai-review Bot added component/ci CI pipelines and checks component/e2e End-to-end tests type/bug Confirmed defect in existing behavior labels Jun 22, 2026

ralphbean mentioned this pull request Jun 22, 2026

fix(#2504): restore e2e fork PR checkout after actions/checkout@v7 bump #2507

Closed

2 tasks

ralphbean added this pull request to the merge queue Jun 22, 2026

Merged via the queue into fullsend-ai:main with commit 0618c31 Jun 22, 2026
19 of 20 checks passed

ralphbean mentioned this pull request Jun 22, 2026

e2e: actions/checkout@v7 rejects fork PR checkouts in pull_request_target workflow #2504

Closed

qodo-code-review Bot mentioned this pull request Jun 22, 2026

ci(functional-tests): use pull_request_target for fork PR support #2534

Merged

3 tasks

ifireball pushed a commit to ifireball/fullsend that referenced this pull request Jun 24, 2026

Merge pull request fullsend-ai#2503 from ifireball/fix/e2e-checkout-v…

b2d1835

…7-unsafe-pr-opt-in fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump

This was referenced Jul 8, 2026

reusable-dispatch: actions/checkout@v7 rejects fork PR checkouts in Route job #3689

Closed

ci(dispatch): allow checkout@v7 fork PR checkout in all reusable workflows #3696

Merged

fullsend-ai-retro Bot mentioned this pull request Jul 8, 2026

Triage agent should trace github context inheritance through workflow_call chains when scoping CI workflow fixes #3745

Open

github-actions Bot deleted the fix/e2e-checkout-v7-unsafe-pr-opt-in branch July 26, 2026 06:08

Navigation Menu

Uh oh!

fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump - #2503

fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump#2503
ralphbean merged 1 commit into
fullsend-ai:mainfrom
ifireball:fix/e2e-checkout-v7-unsafe-pr-opt-in

ifireball commented Jun 22, 2026

Uh oh!

qodo-code-review Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

qodo-code-review Bot commented Jun 22, 2026

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 22, 2026

Uh oh!

ralphbean left a comment

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026

Uh oh!

fullsend-ai-review Bot left a comment

Uh oh!

fullsend-ai-review Bot Jun 22, 2026

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

fullsend-ai-retro Bot commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ifireball commented Jun 22, 2026

Summary

Context

Test plan

Uh oh!

qodo-code-review Bot commented Jun 22, 2026

PR Summary by Qodo

Uh oh!

github-actions Bot commented Jun 22, 2026

Site preview

Uh oh!

qodo-code-review Bot commented Jun 22, 2026

Code Review by Qodo

Great, no issues found!

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jun 22, 2026

Codecov Report

Uh oh!

ralphbean left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot commented Jun 22, 2026

Review

Findings

High

Low

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 22, 2026

Retro: PR #2503 — fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump

Timeline

Assessment

Existing issues already cover observed patterns

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fullsend-ai-review Bot commented Jun 22, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Jun 22, 2026 •

edited

Loading

Retro: PR #2503 — `fix(ci): restore e2e fork PR checkout after actions/checkout@v7 bump`