From 970448ea73fb9e9d7bad443b6204172e89f250e8 Mon Sep 17 00:00:00 2001 From: prql-bot Date: Wed, 24 Jun 2026 19:15:14 +0000 Subject: [PATCH] ci: opt into v7 fork-PR checkout so tend-review runs on fork PRs actions/checkout@v7 refuses fork-PR checkout under pull_request_target unless allow-unsafe-pr-checkout: true is set. Mirrors the upstream tend fix (max-sixty/tend#725, in 0.1.7). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/tend-review.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/tend-review.yaml b/.github/workflows/tend-review.yaml index 3ae47de158d2..afb988ed47e9 100644 --- a/.github/workflows/tend-review.yaml +++ b/.github/workflows/tend-review.yaml @@ -47,6 +47,12 @@ jobs: fetch-depth: 0 fetch-tags: true token: ${{ secrets.TEND_BOT_TOKEN }} + # actions/checkout@v7 refuses fork-PR checkout under + # pull_request_target unless this opts in. Matches the upstream tend + # fix (max-sixty/tend#725, shipped in 0.1.7). Without it, every fork + # PR's `review` check goes red before the review runs. This stopgap + # will be superseded by the next tend 0.1.7 workflow regen. + allow-unsafe-pr-checkout: true - uses: ./.github/actions/tend-setup