Allow unsafe

This is not ideal but is equivalent to what is happening with the v4 version of
the action today. Explicit opt-it is required in v7.

Actions using pull_request_target that are running code from PRs from forks
should be reevaluated so that tests can run without the risk of compromising
the repository.

(cherry picked from commit 18bb240)

Author: samdoran

.github/workflows/e2e_tests.yaml

@@ -34,6 +34,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -30,6 +30,11 @@ jobs:
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'
 

.github/workflows/e2e_tests_providers.yaml

@@ -49,7 +49,7 @@ jobs:
       E2E_DEFAULT_PROVIDER_OVERRIDE: ${{ matrix.e2e_default_provider }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -59,6 +59,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_rhaiis.yaml

@@ -48,6 +48,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}