GitHub Actions Checkout v7: Why Fork Pull Request Safety Required a 362KB Credential Isolation Rewrite
The most-used GitHub Action just shipped breaking changes to how it handles fork pull requests. Checkout v7 refuses to check out fork code by default when workflows run with elevated privileges, and it moved credentials out of .git/config into ephemeral files under $RUNNER_TEMP . Both changes address the same problem: containerized actions and fork contributors can read state they should not see.…
GitHub Actions Checkout v7 has introduced breaking changes to how it handles fork pull requests, requiring a 362KB credential isolation rewrite. These changes aim to address security concerns related to containerized actions and fork contributors potentially accessing sensitive state. By moving credentials out of .git/config into ephemeral files under $RUNNER_TEMP, GitHub has created a privilege boundary, ensuring only the runner process and explicitly granted actions can read the credential file.
This rewrite also marks a migration from CommonJS to ECMAScript Modules (ESM) for the @actions/* packages to support modern Node.js versions.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
