Security / Public reference

Pull request target checkout of PR code

A GitHub Actions workflow that triggers on pull_request_target and checks out the pull request head ref or head sha.

What you need to supply

The workflow YAML. The check does not open the pull request.

If it reports a finding

Critical severity. The suggested next step is to avoid checking out pull request head code from pull_request_target.

What this does not prove

A pull_request workflow, or a pull_request_target workflow that checks out only the base repository, is not this finding.

Checkout that this check is written to notice

on:
  pull_request_target:
jobs:
  build:
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

Proposed change

When this line appears once, the review proposes this change.

ref: ${{ github.event.pull_request.head.ref }} removed

All review checks. Reading this page does not submit your infrastructure.