From a0ce3bbcf0e499cbfc0d51ab6c25e5d5a71dd53a Mon Sep 17 00:00:00 2001 From: Jordan Hury Date: Thu, 1 Oct 2026 15:07:08 +0300 Subject: [PATCH 1/2] Upgrade actions/checkout to v7 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/frogbot-scan-pull-request.yml | 3 ++- .github/workflows/test.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/frogbot-scan-pull-request.yml b/.github/workflows/frogbot-scan-pull-request.yml index b3c8949f..f319af9f 100644 --- a/.github/workflows/frogbot-scan-pull-request.yml +++ b/.github/workflows/frogbot-scan-pull-request.yml @@ -12,9 +12,10 @@ jobs: # "frogbot" GitHub environment can approve the pull request to be scanned. environment: frogbot steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false - uses: jfrog-fastci/fastci@main # Use the FastCI optimization action with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ad008dc6..984566f2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -27,9 +27,10 @@ jobs: JF_CLI_TEST_URL: ${{ secrets.JFROG_CLI_TEST_URL }} JF_CLI_TEST_ACCESS_TOKEN: ${{ secrets.JFROG_CLI_TEST_ACCESS_TOKEN }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false - name: Unlabel 'safe to test' uses: actions-ecosystem/action-remove-labels@v1 From 397236d9aec5b843fe2115ac786c25ee93beb8d8 Mon Sep 17 00:00:00 2001 From: Jordan Hury Date: Sun, 4 Oct 2026 11:57:33 +0300 Subject: [PATCH 2/2] Let pull_request_target workflows check out fork pull requests --- .github/workflows/frogbot-scan-pull-request.yml | 1 + .github/workflows/test.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/frogbot-scan-pull-request.yml b/.github/workflows/frogbot-scan-pull-request.yml index f319af9f..e9c9c5d5 100644 --- a/.github/workflows/frogbot-scan-pull-request.yml +++ b/.github/workflows/frogbot-scan-pull-request.yml @@ -16,6 +16,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} persist-credentials: false + allow-unsafe-pr-checkout: true - uses: jfrog-fastci/fastci@main # Use the FastCI optimization action with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 984566f2..3f270bb5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -31,6 +31,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} persist-credentials: false + allow-unsafe-pr-checkout: true - name: Unlabel 'safe to test' uses: actions-ecosystem/action-remove-labels@v1