# Pull request target checkout of PR code

A GitHub Actions workflow that triggers on pull_request_target and checks out the pull request head ref or head sha.

Area: Security

## What you need to supply

The workflow YAML. The check does not open the pull request.

## If it reports a finding

Critical severity. The suggested next step is to avoid checking out pull request head code from pull_request_target.

## What this does not prove

A pull_request workflow, or a pull_request_target workflow that checks out only the base repository, is not this finding.

## Checkout that this check is written to notice

```
on:
  pull_request_target:
jobs:
  build:
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/pull-request-target-checkout.