From a8d7a622d0ca2f5dfdced31522e523e3ced98ad7 Mon Sep 17 00:00:00 2001 From: Thibault VINCENT Date: Tue, 4 Aug 2026 15:33:49 +0200 Subject: [PATCH] fix(ci): check out the fork repo when syncing the dagger module --- .github/workflows/dagger-module.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/dagger-module.yaml b/.github/workflows/dagger-module.yaml index ade7e45..597fb6d 100644 --- a/.github/workflows/dagger-module.yaml +++ b/.github/workflows/dagger-module.yaml @@ -49,8 +49,17 @@ jobs: # can be pushed back onto it. Credentials are deliberately # persisted here — unlike every other job in this repo, this one # needs git write access. + # + # `repository` must follow `ref`: on a fork PR, head.ref names a + # branch that only exists in the fork, so checking it out against + # the base repo would fail (or resolve a same-named base branch). + # Safe under `pull_request` — the token is read-only and no secrets + # are exposed, and the default checkout already contains the fork's + # code via the merge commit. The fork path only ever reads: pushing + # is gated on IS_FORK below. - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: + repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} ref: ${{ github.event.pull_request.head.ref || github.ref }} fetch-depth: 1