Skip to content

permission_check fails on fork PRs before it checks anything (checkout v7 refuses the head ref) #72

Description

@junkerderprovinz

init-svc-executable-permissions.yml fails on a fork pull request that touches run, finish, check or root/migrations/*. The job stops before any file is read, because actions/checkout@v7.0.1 refuses pull_request.head.sha in a pull_request_target workflow.

PR #190 shows it: https://github.com/linuxserver/docker-baseimage-selkies/actions/runs/33459741080/job/99707212121
The checkout step ends with:

##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

"Check Permissions" is then skipped and the job fails. On that head SHA (a5272e08) all 13 run/finish files are 100755, so the check would have passed.

The switch to checkout 7 reached v1 with 6c9815b on 2026-07-03; the first fork run after that is from 2026-07-06. Since then 45 fork-head runs across linuxserver have failed and 7 internal-head runs have passed. After the switch and before that first fork run, docker-sabnzbd run 28709064096 (2026-07-04) passed: **** All perms look good ****. Twelve open fork pull requests carry a red permission_check; three more are green from before the switch.

f357757 pinned the step to the head SHA because the check needs the PR's own files. The file modes can be read without a checkout: the git trees API on the base repository reaches the fork head through refs/pull/N/head, so the job can flag any matching blob that is not 100755 without fetching fork code. At a5272e08 it returns truncated: false, 151 entries, 13 of them run/finish blobs, all 100755. That leaves pull_request_target and the pinned ref untouched, with no allow-unsafe-pr-checkout. The same checkout step sits in docker-mod-builder.yml, which handles CR_PAT and DOCKERPASS.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions