checkout: GitHub Actions Default Checkout That Fundamentally Blocks Fork PR Code Execution

This is the standard action for cloning a repository and fetching only the necessary files in a GitHub Actions workflow. It places the repository in $GITHUB_WORKSPACE so that scripts can directly reference the code. By default, it fetches only the single commit of the triggered event, but you can adjust the fetch-depth option to selectively load the full history or a specific branch.

Security hardening is the core focus starting from v7. It denies checking out code from forked repositories by default when triggered by pull_request_target or workflow_run. This measure prevents the 'pwn request' vulnerability, where external code executes with the base repository's tokens and secrets exposed. If you need to execute fork code after acknowledging the risks, you must explicitly enable the allow-unsafe-pr-checkout option.

The credential management approach has also changed. Starting from v6, persist-credentials stores credentials in a separate file under $RUNNER_TEMP instead of .git/config. This allows authenticated commands like git fetch or push to be performed automatically while preventing sensitive information from being exposed in configuration files. Actions Runner v2.329.0 or higher is required to run authenticated git commands in Docker containers.

You can use sparse-checkout to selectively fetch only the necessary folders or files, reducing build times. It supports various options such as Git-LFS file downloads, submodule checkout, and SSH key-based authentication. Currently, this repository does not accept external contributions; bug reports and security updates are handled through community discussions and official support channels.