From 09a663b506eb91c4a2c04ed6b7b2f3dbca2e4e3a Mon Sep 17 00:00:00 2001 From: Tim Donohue Date: Fri, 17 Jul 2026 11:26:39 -0500 Subject: [PATCH] Fix broken job by allowing "unsafe checkout". Add comment to describe why. Also tweak the run statement to only trigger job if a "port to" label exists. --- .github/workflows/port_merged_pull_request.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/port_merged_pull_request.yml b/.github/workflows/port_merged_pull_request.yml index ccafeff61d3..14fa51009d9 100644 --- a/.github/workflows/port_merged_pull_request.yml +++ b/.github/workflows/port_merged_pull_request.yml @@ -19,11 +19,21 @@ permissions: jobs: port_pr: runs-on: ubuntu-slim - # Don't run on closed *unmerged* pull requests - if: github.event.pull_request.merged + # Only run on MERGED pull requests, + # and only run if the merged PR has a label that starts with "port to" + if: > + github.event.pull_request.merged && + contains(toJSON(github.event.pull_request.labels.*.name), '"port to ') steps: # Checkout code - uses: actions/checkout@v7 + with: + # When using 'pull_request_target' (see above), this 'checkout' step will always fail because it + # may make the codebase vulnerable to "pwn requests" via the user-created PR. + # See https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target + # However, we are allowing this unsafe checkout because (1) it's required to backport the PR, and + # (2) this job only runs when a PR is MERGED, and merger only happens after a thorough review of the PR. + allow-unsafe-pr-checkout: true # Port PR to other branch (ONLY if labeled with "port to") # See https://github.com/korthout/backport-action - name: Create backport pull requests