From 2164d7cf0d72b288b85806990350b107416b9aa9 Mon Sep 17 00:00:00 2001
From: ibolton336 <ibolton@redhat.com>
Date: Mon, 20 Jul 2026 15:23:22 -0400
Subject: [PATCH] :seedling: Fix changelog fragment check for fork PRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

actions/checkout refuses to check out fork PR head commits in
pull_request_target workflows, so the 'Verify changelog fragment' job
failed for every fork PR. Check out the base repo instead and fetch the
PR head as a plain ref for the diff — PR code is never checked out.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: ibolton336 <ibolton@redhat.com>
---
 .github/workflows/pr-checks.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 3d512c1..380ce47 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -23,13 +23,20 @@ jobs:
     if: contains(fromJSON('["feature", "bugfix", "breaking"]'), needs.verify.outputs.pr_type)
     name: Verify changelog fragment
     steps:
+      # actions/checkout refuses to check out fork PR code in a
+      # pull_request_target workflow, so check out the base repo and fetch
+      # the PR head as a ref that is only diffed, never checked out or run.
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          persist-credentials: false
+      - name: Fetch PR head ref
+        run: git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
       - name: Check for changelog fragment
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
-          FRAGMENTS=$(git diff --name-only --diff-filter=AM origin/${{ github.event.pull_request.base.ref }}...HEAD -- 'changes/unreleased/*.yaml' 'changes/unreleased/*.yml')
+          FRAGMENTS=$(git diff --name-only --diff-filter=AM "origin/${BASE_REF}...pr-head" -- 'changes/unreleased/*.yaml' 'changes/unreleased/*.yml')
           if [ -z "$FRAGMENTS" ]; then
             echo "::error::This is a ${{ needs.verify.outputs.pr_type }} PR — a changelog fragment is required in changes/unreleased/"
             echo ""