pull_request_target checks out the pull request (ARCH10032)

Key config.ci.pull-request-target-checkout · Severity error · Category security · CWE CWE-829

A pull_request_target workflow runs in the base repository’s context, with its secrets and a write token. Checking out the pull request’s head there and building or testing it runs code anyone can propose with those rights.

Incorrect

on: pull_request_target
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: npm ci && npm test

Correct

on: pull_request
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm test

Fix

Use pull_request for anything that builds or runs the change; keep a pull_request_target job away from the change’s code (labels, comments).

Not flagged

• actions/checkout without a ref in a pull_request_target workflow: it checks out the base branch.