{
  "id": "P027",
  "slug": "actions-checkout-new-default-blocks-untrusted-fork-code-unsafe-opt-out-expose-secrets-fork-pull",
  "status": "search-observed",
  "product": "actions/checkout",
  "family": "CI event security semantics",
  "canonical_url": "https://gitdocs.org/fix/actions-checkout-new-default-blocks-untrusted-fork-code-unsafe-opt-out-expose-secrets-fork-pull",
  "query_alias_url": "https://gitdocs.org/q/actions-checkout-new-default-blocks-untrusted-fork-code-unsafe-opt-out-expose-secrets-fork-pull",
  "markdown_url": "https://gitdocs.org/fix/actions-checkout-new-default-blocks-untrusted-fork-code-unsafe-opt-out-expose-secrets-fork-pull.md",
  "json_url": "https://gitdocs.org/api/fixes/actions-checkout-new-default-blocks-untrusted-fork-code-unsafe-opt-out-expose-secrets-fork-pull.json",
  "canonical_query": "actions/checkout new default blocks untrusted fork code unsafe opt-out expose secrets fork pull request",
  "observed_codex_queries": [
    "actions/checkout new default blocks untrusted fork code unsafe opt-out expose secrets fork pull request",
    "GitHub Actions fork pull request workflows approval default secrets unsafe opt out",
    "site:docs.github.com actions pull_request_target checkout fork head secrets warning",
    "GitHub Docs pull_request_target warning checkout head sha fork secrets",
    "docs.github.com pull_request_target untrusted code build run secrets warning",
    "https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows",
    "'pull_request_target' in https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows"
  ],
  "organic_dependency_search_count": 7,
  "affected_versions": "",
  "exact_errors": [],
  "diagnosis": "Workflow YAML alone does not encode GitHub's current trust policy for forked refs and privileged events.",
  "before": "",
  "after": "",
  "verification": "Verifier checks that untrusted code is not executed with privileged credentials and that the intended trusted ref is checked out. Reject patches that simply expose secrets to fork code.",
  "unsafe_fixes": [
    "Changing local code without checking the current external contract.",
    "Retrying the same install, build, or API call with no version/source change.",
    "Applying a broad unsafe bypass when a narrow compatibility fix is available."
  ],
  "last_verified_at": "2026-06-25",
  "neutral_validation": {
    "organic_search_observed": true,
    "organic_strict_pass": true,
    "no_web_counterfactual_run": false,
    "no_web_strict_pass": null,
    "search_necessity_under_fixture": null,
    "no_web_oracle_note": "Observed query evidence is separated from necessity proof; no-web and stale-contract counterfactuals should be tracked separately."
  },
  "source_trail": [
    {
      "url": "https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/",
      "label": "Safer pull_request_target defaults for actions/checkout"
    },
    {
      "url": "https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows",
      "label": "GitHub source file or repository reference"
    }
  ],
  "source_github_links": [
    {
      "url": "https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows",
      "label": "GitHub source file or repository reference"
    }
  ]
}