block checking out fork pr for pull_request_target and workflow_run

[aiqiaoy]

Implements https://github.com/github/c2c-actions/pull/10159

TL;DR; This PR adds a check that refuses to check out fork pull request code when the workflow trigger is either pull_request_target or workflow_run, unless the workflow author explicitly opts in via a new input allow-unsafe-pr-checkout: true.

[Copilot]

Pull request overview

Adds a guardrail to prevent accidentally checking out fork pull request code in privileged GitHub Actions contexts (pull_request_target and PR-triggered workflow_run), with an explicit opt-in escape hatch for advanced workflows.

Changes:

• Introduces assertSafePrCheckout to detect and block unsafe fork-PR checkouts in privileged events unless allow-unsafe-pr-checkout is enabled.
• Adds a new action input (allow-unsafe-pr-checkout) and threads it through input parsing and settings.
• Updates documentation and adds test coverage for the new safety checks.

Show a summary per file

File	Description
src/unsafe-pr-checkout-helper.ts	New helper that blocks unsafe fork PR checkout patterns in privileged events unless opted in.
src/ref-helper.ts	Exports fromPayload for reuse by the new safety helper.
src/input-helper.ts	Parses allow-unsafe-pr-checkout and invokes the new safety assertion during input handling.
src/git-source-settings.ts	Extends settings interface with allowUnsafePrCheckout.
README.md	Documents the new input and its intent.
action.yml	Adds the new input to the action metadata.
test/unsafe-pr-checkout-helper.test.ts	New unit tests validating allow/refuse behavior across events and patterns.
test/input-helper.test.ts	Asserts the new setting defaults to false.
test/git-auth-helper.test.ts	Updates test settings object to include the new required field.
dist/index.js	Bundled output updated to include the new logic.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 9/10 changed files
• Comments generated: 4