{
  "schema_version": "1.0",
  "id": "archive:https://github.com/actions/checkout",
  "slug": "checkout-0hxxb1v",
  "url": "https://feed7.dev/p/checkout-0hxxb1v",
  "title": "actions/checkout",
  "why_included": "The standard GitHub Action that checks out your repo in CI. v7 now refuses to check out fork PR code by default under pull_request_target/workflow_run—a security default worth knowing if your agent edits workflows. ~129 stars today.",
  "summary": "**The gist** `actions/checkout` checks out a repo into `$GITHUB_WORKSPACE` for GitHub Actions workflows. Current major is **v7** (June 18, 2026): it now **refuses to check out fork pull request code by default** under `pull_request_target` or `workflow_run`, migrated to **ESM**, and (since v6) stores credentials in `$RUNNER_TEMP` instead of `.git/config`.",
  "practical_implication": "**Why it matters** If you or your agent generate CI workflows, the v7 fork-PR default closes a common privilege-escalation footgun—opt back in only via `allow-unsafe-pr-checkout` after a risk review. Defaults to a single-commit fetch; use `fetch-depth: 0` for full history and `sparse-checkout` to grab only specific paths.",
  "agent_context": "**The gist** `actions/checkout` checks out a repo into `$GITHUB_WORKSPACE` for GitHub Actions workflows. Current major is **v7** (June 18, 2026): it now **refuses to check out fork pull request code by default** under `pull_request_target` or `workflow_run`, migrated to **ESM**, and (since v6) stores credentials in `$RUNNER_TEMP` instead of `.git/config`.\n\n**Why it matters** If you or your agent generate CI workflows, the v7 fork-PR default closes a common privilege-escalation footgun—opt back in only via `allow-unsafe-pr-checkout` after a risk review. Defaults to a single-commit fetch; use `fetch-depth: 0` for full history and `sparse-checkout` to grab only specific paths.\n\n**Watch out** Recommended `permissions: { contents: read }`. Upgrading to v7 can break workflows that relied on the old fork-PR behavior or on credentials living in `.git/config`—test before bumping. ~15.3M dependents mean wide blast radius for any change.",
  "source": {
    "name": "GitHub",
    "url": "https://github.com/actions/checkout",
    "published_at": null
  },
  "source_class": "tool",
  "content_type": "GitHub Repo",
  "layer": null,
  "domains": [],
  "topics": [],
  "verification": {
    "status": "needs_review",
    "label": "Needs Review",
    "method": "unverified",
    "verified_at": null
  },
  "uncertainty": [
    "Recommended `permissions: { contents: read }`. Upgrading to v7 can break workflows that relied on the old fork-PR behavior or on credentials living in `.git/config`—test before bumping. ~15.3M dependents mean wide blast radius for any change."
  ],
  "lifecycle": "Current",
  "published_at": null,
  "modified_at": null,
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/checkout-0hxxb1v",
    "json": "https://feed7.dev/p/checkout-0hxxb1v.json",
    "markdown": "https://feed7.dev/p/checkout-0hxxb1v.md"
  }
}