What is the security risk of using `actions/checkout` with a PR’s head SHA versus the merge SHA in `pull_request_target` workflows?

Question

Github — Hard

What is the security risk of using `actions/checkout` with a PR’s head SHA versus the merge SHA in `pull_request_target` workflows?

Accepted Answer

Using `actions/checkout` with a PR's head SHA in `pull_request_target` workflows poses a security risk. This is because checking out untrusted fork code runs attacker-controlled code with access to repository secrets and write permissions. In contrast, checking out the base branch SHA or merge SHA is safe.