Fix claude-review checking out untrusted fork PR head#34
Merged
jnasbyupgrade merged 1 commit intoJul 26, 2026
Merged
Conversation
The checkout step used pull_request_target with repository/ref set to the fork's PR head — GitHub Actions refuses this combination by default (the pwn-request guard) unless allow-unsafe-pr-checkout is set, so the review's checkout step failed deterministically whenever the cost gate reached decision=run. Per anthropics/claude-code-action's own security guidance (docs/security.md), the preferred fix for pull_request_target is to check out the base ref (not the fork's head) and let the action read PR content via the GitHub API. It already has a GitHub token and pull-requests read/write for posting the review, so it can fetch the diff itself without ever writing fork code to disk. This also preserves pull_request_target (and the secrets/token access it provides), which pull_request cannot — that path was already tried and doesn't work for fork PRs. Fixes Postgres-Extensions#33 Co-Authored-By: Claude Sonnet 5 <[email protected]>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jnasbyupgrade
added a commit
to jnasbyupgrade/pgxntool
that referenced
this pull request
Jul 26, 2026
Supersede the allow-unsafe-pr-checkout opt-in from the previous commit. Per anthropics/claude-code-action's own security guidance (docs/security.md), the preferred pattern for pull_request_target is to check out the base ref only and let the action read PR content via the GitHub API — it already has a token with pull-requests read/write. This avoids ever writing fork code to disk, rather than opting into the "unsafe" checkout flag. Matches the fix applied in the paired pgxntool-test PR (Postgres-Extensions/pgxntool-test#34). Co-Authored-By: Claude Sonnet 5 <[email protected]>
jnasbyupgrade
merged commit Jul 26, 2026
ba85db5
into
Postgres-Extensions:master
8 of 9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related pgxntool PR: Postgres-Extensions/pgxntool#70
actions/checkoutrefuses fork-PR checkouts underpull_request_targetunlessallow-unsafe-pr-checkout: trueis set explicitly. This broke theclaude-reviewjob's checkout step deterministically whenever its internal cost gate reacheddecision=run(see the failing run linked from pgxntool #60: https://github.com/Postgres-Extensions/pgxntool/actions/runs/30218144501/job/89835769849).Check out the base branch only (drop
repository:/ref:) instead of the fork's head, rather than opting into the unsafe flag. Peranthropics/claude-code-action's own security guidance (docs/security.md), this is the preferred pattern forpull_request_target: the action reads PR content via its own GitHub token/API (already haspull-requestsread/write for posting the review) rather than needing the fork's files checked out locally.This keeps
pull_request_target(needed for fork PRs to accessCLAUDE_CODE_OAUTH_TOKEN— plainpull_requestwithholds secrets from fork-triggered runs, per the existing comment in this file). Becausepull_request_targetalways runs the workflow file from the base branch, this specific check can't turn green on its own PR — it will only start passing on PRs opened after this merges.Fixes #33