run prettier formatting

README.md

@@ -162,11 +162,8 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     github-server-url: ''
 
     # Required to check out fork pull request code from a workflow triggered by
-    # `pull_request_target` or `workflow_run`. These workflows run with the base
+    # `pull_request_target` or `workflow_run`. See [Pwn Requests](todo:need-link) for
-    # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
+    # the risks. Set to `true` only after reviewing the risks.
-    # access; fetching and executing a fork's code in that trusted context commonly
-    # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
-    # risks at https://gh.io/securely-using-pull_request_target.
     # Default: false
     allow-unsafe-pr-checkout: ''
 ```

__test__/input-helper.test.ts

@@ -155,50 +155,4 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  describe('unsafe PR checkout guard', () => {
-    const forkPayload = {
-      repository: {id: 100},
-      pull_request: {
-        head: {
-          sha: '1234567890123456789012345678901234567890',
-          repo: {id: 200, full_name: 'attacker/fork'}
-        },
-        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-      }
-    }
-
-    it('allows the default self-checkout on a fork pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
-        // equals the PR head SHA. The default self-checkout must still succeed.
-        github.context.sha = '1234567890123456789012345678901234567890'
-        const settings: IGitSourceSettings = await inputHelper.getInputs()
-        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-      }
-    })
-
-    it('refuses an explicit fork repository on pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        inputs.repository = 'attacker/fork'
-        await expect(inputHelper.getInputs()).rejects.toThrow(
-          /Refusing to check out fork pull request code/
-        )
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-      }
-    })
-  })
 })

action.yml

@@ -101,11 +101,8 @@ inputs:
   allow-unsafe-pr-checkout:
     description: >
       Required to check out fork pull request code from a workflow triggered by
-      `pull_request_target` or `workflow_run`. These workflows run with the
+      `pull_request_target` or `workflow_run`. See [Pwn Requests](todo:need-link)
-      base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
+      for the risks. Set to `true` only after reviewing the risks.
-      runner access; fetching and executing a fork's code in that trusted
-      context commonly leads to "pwn request" vulnerabilities. Set to `true`
-      only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
     default: false
 outputs:
   ref:

dist/index.js

@@ -2150,19 +2150,12 @@ function getInputs() {
             (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
                 'TRUE';
         core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-        // The default self-checkout (this repository with no explicit ref) always
+        unsafePrCheckoutHelper.assertSafePrCheckout({
-        // resolves to the trusted ref/commit GitHub set for the triggering event, so
+            qualifiedRepository,
-        // the fork-checkout guard only needs to run when the caller customized the
+            ref: result.ref,
-        // repository or ref.
+            commit: result.commit,
-        const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref');
+            allowUnsafePrCheckout: result.allowUnsafePrCheckout
-        if (!isDefaultCheckout) {
+        });
-            unsafePrCheckoutHelper.assertSafePrCheckout({
-                qualifiedRepository,
-                ref: result.ref,
-                commit: result.commit,
-                allowUnsafePrCheckout: result.allowUnsafePrCheckout
-            });
-        }
         return result;
     });
 }
@@ -2829,7 +2822,8 @@ function assertSafePrCheckout(input) {
     // (B) We cannot check for all fork PR refs so check to see
     // if the resolved input points to the fork PR sha we have in the payload
     const repositoryMatchesPrHead = typeof prHeadRepoFullName === 'string' &&
-        input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase();
+        input.qualifiedRepository.toLowerCase() ===
+            prHeadRepoFullName.toLowerCase();
     const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref);
     const commitMatchesPrHeadSha = !!input.commit && prShas.includes(input.commit.toLowerCase());
     if (!repositoryMatchesPrHead &&
@@ -2839,10 +2833,9 @@ function assertSafePrCheckout(input) {
     }
     throw new Error(`Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
         `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-        `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
+        `cache scope, and runner access. Fetching fork's code in that trusted context is a ` +
-        `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
+        `"pwn request" supply-chain attack pattern. To opt in after reviewing the risk, set ` +
-        `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
+        `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`);
-        `on the actions/checkout step.`);
 }
 function pushIfSha(target, value) {
     if (typeof value === 'string' && value.length > 0) {

src/input-helper.ts

@@ -168,19 +168,12 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     'TRUE'
   core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
 
-  // The default self-checkout (this repository with no explicit ref) always
+  unsafePrCheckoutHelper.assertSafePrCheckout({
-  // resolves to the trusted ref/commit GitHub set for the triggering event, so
+    qualifiedRepository,
-  // the fork-checkout guard only needs to run when the caller customized the
+    ref: result.ref,
-  // repository or ref.
+    commit: result.commit,
-  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
+    allowUnsafePrCheckout: result.allowUnsafePrCheckout
-  if (!isDefaultCheckout) {
+  })
-    unsafePrCheckoutHelper.assertSafePrCheckout({
-      qualifiedRepository,
-      ref: result.ref,
-      commit: result.commit,
-      allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    })
-  }
 
   return result
 }

src/unsafe-pr-checkout-helper.ts

@@ -74,10 +74,9 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
   throw new Error(
     `Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
       `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-      `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
+      `cache scope, and runner access. Fetching fork's code in that trusted context is a ` +
-      `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
+      `"pwn request" supply-chain attack pattern. To opt in after reviewing the risk, set ` +
-      `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
+      `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`
-      `on the actions/checkout step.`
   )
 }