init-svc-executable-permissions.yml fails on a fork pull request that touches run, finish, check or root/migrations/*. The job stops before any file is read, because actions/checkout@v7.0.1 refuses pull_request.head.sha in a pull_request_target workflow.
PR #190 shows it: https://github.com/linuxserver/docker-baseimage-selkies/actions/runs/33459741080/job/99707212121
The checkout step ends with:
##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.
"Check Permissions" is then skipped and the job fails. On that head SHA (a5272e08) all 13 run/finish files are 100755, so the check would have passed.
The switch to checkout 7 reached v1 with 6c9815b on 2026-07-03; the first fork run after that is from 2026-07-06. Since then 45 fork-head runs across linuxserver have failed and 7 internal-head runs have passed. After the switch and before that first fork run, docker-sabnzbd run 28709064096 (2026-07-04) passed: **** All perms look good ****. Twelve open fork pull requests carry a red permission_check; three more are green from before the switch.
f357757 pinned the step to the head SHA because the check needs the PR's own files. The file modes can be read without a checkout: the git trees API on the base repository reaches the fork head through refs/pull/N/head, so the job can flag any matching blob that is not 100755 without fetching fork code. At a5272e08 it returns truncated: false, 151 entries, 13 of them run/finish blobs, all 100755. That leaves pull_request_target and the pinned ref untouched, with no allow-unsafe-pr-checkout. The same checkout step sits in docker-mod-builder.yml, which handles CR_PAT and DOCKERPASS.
init-svc-executable-permissions.ymlfails on a fork pull request that touchesrun,finish,checkorroot/migrations/*. The job stops before any file is read, becauseactions/checkout@v7.0.1refusespull_request.head.shain apull_request_targetworkflow.PR #190 shows it: https://github.com/linuxserver/docker-baseimage-selkies/actions/runs/33459741080/job/99707212121
The checkout step ends with:
"Check Permissions" is then skipped and the job fails. On that head SHA (a5272e08) all 13
run/finishfiles are 100755, so the check would have passed.The switch to checkout 7 reached v1 with 6c9815b on 2026-07-03; the first fork run after that is from 2026-07-06. Since then 45 fork-head runs across linuxserver have failed and 7 internal-head runs have passed. After the switch and before that first fork run, docker-sabnzbd run 28709064096 (2026-07-04) passed:
**** All perms look good ****. Twelve open fork pull requests carry a red permission_check; three more are green from before the switch.f357757 pinned the step to the head SHA because the check needs the PR's own files. The file modes can be read without a checkout: the git trees API on the base repository reaches the fork head through
refs/pull/N/head, so the job can flag any matching blob that is not100755without fetching fork code. At a5272e08 it returnstruncated: false, 151 entries, 13 of themrun/finishblobs, all100755. That leavespull_request_targetand the pinned ref untouched, with noallow-unsafe-pr-checkout. The same checkout step sits indocker-mod-builder.yml, which handles CR_PAT and DOCKERPASS.