Add parameter to fix checkout - #9929
Merged
Merged
Conversation
amd-gevadlam
requested review from
a team,
manikandan-xilinx and
stsoe
as code owners
July 20, 2026 20:34
stsoe
requested changes
Jul 20, 2026
stsoe
left a comment
stsoe
left a comment
Collaborator
There was a problem hiding this comment.
For history sake, it would be helpful to explain the change in the PR description.
Contributor
|
clang-tidy review says "All clean, LGTM! 👍" |
Collaborator
Author
Added, Could you please review? We neeed to get this merged in order to reflect in the CI builds. The PR build would still fail because it takes only the master's CI code. |
stsoe
approved these changes
Jul 20, 2026
stsoe
left a comment
stsoe
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. Thanks for adding the description.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The actions/checkout@v3 tag was updated upstream to include a new security guardrail that blocks checking out fork PR code in pull_request_target workflows by default. This is to prevent "pwn request" vulnerabilities where untrusted fork code runs with access to the base repo's secrets and GITHUB_TOKEN.
PRs before July 18 (e.g. #9926) were unaffected because they ran against the older checkout SHA. PRs after (e.g. #9927) all fail at checkout before the build even starts.
Fix
Add allow-unsafe-pr-checkout: true to the three "Checkout PR" steps in xrt_ci.yml (in the build, windows-build, and apu-package-build jobs).
This is safe in our workflow because the authorize job already gates all builds behind an allowlist check — untrusted fork authors cannot trigger builds without prior approval.