Validation workflow fails with pull_request_target checkout security error on fork PRs #44

Reported by

@Muhax

Description

The automated validation workflow fails on pull requests submitted from a fork,
before any metadata/logo validation can run.

Steps to Reproduce

1. Fork App-Store-Data (fork: Muhax/App-Store-Data)
2. Add a new app under repositories/Muhax/App-Store-Data/<App Name>/
3. Open a PR against BruceDevices/App-Store-Data:main

Error

The validate-metadata job fails at the actions/checkout@v4 step for the
PR head (pr-repo), with:

##[error]Refusing to check out fork pull request code from a 'pull_request_target'
workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets,
default-branch cache scope, and runner access. Fetching and executing a fork's
code in that trusted context commonly leads to "pwn request" vulnerabilities.
To opt in, review the risks at https://gh.io/securely-using-pull_request_target
and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

Context

• PR Add Muhax Sniffer app #43
• Event: pull_request_target
• Head repo: Muhax/App-Store-Data
• Base repo: BruceDevices/App-Store-Data
• Head SHA: 276f321701701e1e781791b19494e7bd3b328a98

Expected Behavior

The validation job should be able to check out the PR's changed files (in a
sandboxed/read-only way) so metadata.json and logo.png can be validated,
without granting the fork PR access to secrets.

Possible Fix

Since pull_request_target runs with base-repo permissions by default, this
likely needs either:

• allow-unsafe-pr-checkout: true on the checkout step (with appropriate
  sandboxing of anything executed from PR content), or
• switching the validation job to a regular pull_request trigger if it
  doesn't actually need base-repo secrets for read-only metadata checks.

Happy to provide more logs if needed.