block checking out fork pr for pull_request_target and workflow_run
Merged
AI
4mo ago+509+509+012345678901234567890123456789-2-2-0123456789
Implements https://github.com/github/c2c-actions/pull/10159
TL;DR; This PR adds a check that refuses to check out fork pull request code when the workflow trigger is either pull_request_target or workflow_run, unless the workflow author explicitly opts in via a new input allow-unsafe-pr-checkout: true.