mirror of
https://github.com/webstudio-is/webstudio.git
synced 2026-11-02 18:18:35 +09:00
Oleg Isonen
cb1a17dc9b
Approved fork workflows currently fail before tests start. GitHub rejects the fork-head checkout in the trusted `pull_request_target` context even after the `safe-to-deploy` label is applied. ## Implementation - Opt into the fork checkout for every reusable Main workflow job only when the event is a `safe-to-deploy` label approval. - Apply the same guard to the nested fixture workflow. - Keep normal pushes and regular pull request checkouts unchanged. ## Todo - [x] Guard all Main workflow checkouts. - [x] Guard the nested fixture workflow checkout. - [x] Verify the opt-in remains false for normal pushes and pull requests. - [x] Review documentation impact: no product documentation is affected. - [x] Review fixture impact: no fixture inputs or generated outputs are affected. - [ ] Merge this change into `main`, then reapply `safe-to-deploy` to the affected fork PR. ## Verification - [x] Prettier check for both changed workflows. - [x] `git diff --check`. - [x] Confirmed all seven Main checkouts and the fixture checkout use the guarded opt-in. ## Known limitation GitHub loads `pull_request_target` workflow definitions from the default branch. The repaired approved-fork run can only be verified after this change reaches `main`. Ref #6332 Ref #6329