From 8a87820946546f999be75049339f4248ffb48b59 Mon Sep 17 00:00:00 2001
From: staryxchen <staryxchen@tencent.com>
Date: Mon, 31 Aug 2026 13:16:02 +0000
Subject: [PATCH] [CI] Keep Ascend mirror retry on actions/checkout

The ghfast fallback used raw git fetch, which skipped checkout's
pull_request_target fork check and ran untrusted PR heads on the
privileged self-hosted job. Rewrite github.com via insteadOf and retry
the same action so network failures still use the mirror.

Signed-off-by: staryxchen <staryxchen@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/ci_ascend.yml | 37 ++++++++++++++-------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci_ascend.yml b/.github/workflows/ci_ascend.yml
index 13f79a244f..1f2b6d1ea2 100644
--- a/.github/workflows/ci_ascend.yml
+++ b/.github/workflows/ci_ascend.yml
@@ -45,12 +45,13 @@ jobs:
         fetch-depth: 1
         persist-credentials: false
 
-    - name: Retry checkout via GitHub mirror
+    # Mirror is only a git transport fallback. Keep retry on actions/checkout so
+    # pull_request_target fork checks still run; do not fetch with raw git.
+    - name: Configure GitHub mirror rewrite
       if: steps.checkout_code.outcome == 'failure'
       shell: bash
       env:
         ASCEND_GITHUB_MIRROR_URLS: 'https://ghfast.top/'
-        CHECKOUT_REF: ${{ inputs.checkout_ref || github.sha }}
       run: |
         set -euo pipefail
 
@@ -83,27 +84,21 @@ jobs:
 
         workdir="${GITHUB_WORKSPACE}"
         git config --global --add safe.directory "$workdir"
+        find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
 
-        for base in "${candidates[@]}"; do
-          mirror_url="${base}https://github.com/${GITHUB_REPOSITORY}.git"
-          echo "Retrying checkout with ${mirror_url}"
-
-          find "$workdir" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-          git init "$workdir"
-          git -C "$workdir" remote add origin "$mirror_url"
-
-          if git -C "$workdir" fetch --depth=1 origin "$CHECKOUT_REF" && \
-             git -C "$workdir" checkout --force --detach FETCH_HEAD; then
-            echo "Mirror checkout succeeded via ${base}"
-            exit 0
-          fi
-
-          echo "Mirror checkout failed via ${base}"
-          rm -rf "$workdir/.git"
-        done
+        # insteadOf only rewrites github.com fetches; checkout still runs
+        # assertSafePrCheckout before any git network I/O.
+        mirror_base="${candidates[0]}"
+        echo "Rewriting https://github.com/ to ${mirror_base}https://github.com/"
+        git config --global url."${mirror_base}https://github.com/".insteadOf "https://github.com/"
 
-        echo "Direct GitHub checkout failed and all mirror retries failed"
-        exit 1
+    - name: Retry checkout via GitHub mirror
+      if: steps.checkout_code.outcome == 'failure'
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.checkout_ref || github.sha }}
+        fetch-depth: 1
+        persist-credentials: false
 
     - name: Configure CMake
       shell: bash