From 2727d12e1338970ac568d24c63873ea6abde8006 Mon Sep 17 00:00:00 2001
From: tmimmanuel <14046872+tmimmanuel@users.noreply.github.com>
Date: Thu, 30 Jul 2026 14:42:39 +0000
Subject: [PATCH] Allow fork PR checkout in pull_request_target workflow

Adds allow-unsafe-pr-checkout: true to both Checkout PR contents steps
in pr-automation.yml. Required when using pull_request_target with fork
PRs (miner submissions), otherwise actions/checkout@v4 refuses to fetch
the fork's code in the trusted workflow context.
---
 .github/workflows/pr-automation.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml
index 4c73adf..735a845 100644
--- a/.github/workflows/pr-automation.yml
+++ b/.github/workflows/pr-automation.yml
@@ -33,6 +33,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           path: pr
           persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Label PR and classify submission
         id: classify
@@ -225,6 +226,7 @@ jobs:
           ref: ${{ steps.prmeta.outputs.head_sha }}
           path: pr
           persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Checkout validator scripts
         uses: actions/checkout@v4