Need to checkout repo to use composite actions

department-of-veterans-affairs · Dec 7, 2023 · 721b86d · 721b86d
1 parent 8442757
commit 721b86d
Show file tree

Hide file tree

Showing 3 changed files with 33 additions and 0 deletions.
diff --git a/.github/workflows/tugboat-pr-closed.yml b/.github/workflows/tugboat-pr-closed.yml
@@ -11,6 +11,17 @@ jobs:
       NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
     name: Delete Tugboat Preview
     steps:
+    # The following checks out the code from the pull request.
+    #
+    # This is not normally secure or recommended.  It is safe in this context,
+    # however, because we are not executing any code located within the PR
+    # branch or its commits, regardless of provenance.
+    #
+    # Do not execute any code located within the repository!
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Documentation Only PR Check
       uses: ./.github/actions/docs-only
       id: docs-only

diff --git a/.github/workflows/tugboat-pr-opened.yml b/.github/workflows/tugboat-pr-opened.yml
@@ -12,6 +12,17 @@ jobs:
       NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
     name: Create Tugboat Preview
     steps:
+    # The following checks out the code from the pull request.
+    #
+    # This is not normally secure or recommended.  It is safe in this context,
+    # however, because we are not executing any code located within the PR
+    # branch or its commits, regardless of provenance.
+    #
+    # Do not execute any code located within the repository!
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Documentation Only PR Check
       uses: ./.github/actions/docs-only
       id: docs-only

diff --git a/.github/workflows/tugboat-pr-updated.yml b/.github/workflows/tugboat-pr-updated.yml
@@ -11,6 +11,17 @@ jobs:
       NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
     name: Rebuild Tugboat Preview
     steps:
+    # The following checks out the code from the pull request.
+    #
+    # This is not normally secure or recommended.  It is safe in this context,
+    # however, because we are not executing any code located within the PR
+    # branch or its commits, regardless of provenance.
+    #
+    # Do not execute any code located within the repository!
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha }}
     - name: Documentation Only PR Check
       uses: ./.github/actions/docs-only
       id: docs-only