From 1b996894a1bba71e69ecd3aad1716a4d2da4028b Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 21:29:48 +0000 Subject: [PATCH 1/2] ci: set allow-unsafe-pr-checkout on fork PR checkout in test-warehouse Co-Authored-By: Itamar Hartstein --- .github/workflows/test-warehouse.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/test-warehouse.yml b/.github/workflows/test-warehouse.yml index 891db7e09..34a9ceeef 100644 --- a/.github/workflows/test-warehouse.yml +++ b/.github/workflows/test-warehouse.yml @@ -86,6 +86,13 @@ jobs: with: path: dbt-data-reliability ref: ${{ inputs.dbt-data-reliability-ref }} + # Fork PRs are tested via pull_request_target intentionally: the + # integration tests need the CI secrets of our test warehouses, which + # a pull_request run of a fork cannot access. The caller + # (test-all-warehouses.yml) gates fork PRs behind the + # elementary_test_env environment, so a maintainer must approve the + # run before this fork code is checked out and executed. + allow-unsafe-pr-checkout: true - name: Configure AWS credentials if: inputs.warehouse-type == 'athena' From 901f55dbe8d04491b21839aea0c4aab668bd276f Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 21:37:36 +0000 Subject: [PATCH 2/2] ci: don't persist git credentials for fork PR checkouts Co-Authored-By: Itamar Hartstein --- .github/workflows/test-warehouse.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/test-warehouse.yml b/.github/workflows/test-warehouse.yml index 34a9ceeef..675d65cc2 100644 --- a/.github/workflows/test-warehouse.yml +++ b/.github/workflows/test-warehouse.yml @@ -80,12 +80,16 @@ jobs: repository: elementary-data/elementary path: elementary ref: ${{ inputs.elementary-ref }} + persist-credentials: false - name: Checkout dbt package uses: actions/checkout@v6 with: path: dbt-data-reliability ref: ${{ inputs.dbt-data-reliability-ref }} + # Don't leave the base repo's token in the git config: the checked out + # code is fork-controlled (see below) and nothing here pushes. + persist-credentials: false # Fork PRs are tested via pull_request_target intentionally: the # integration tests need the CI secrets of our test warehouses, which # a pull_request run of a fork cannot access. The caller