From b4edffb57eebf54c7f774fab2c832baa52174836 Mon Sep 17 00:00:00 2001 From: Denis Arnst Date: Thu, 22 Jan 2026 16:04:15 +0100 Subject: [PATCH 1/2] Clang format PR CI fix --- .github/workflows/clang-format.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index 56eb72eb..2d8961c4 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -1,7 +1,7 @@ name: Code Style Check on: - pull_request: + pull_request_target: paths: - '**.c' - '**.cpp' @@ -19,6 +19,8 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 + ref: ${{ github.event.pull_request.head.sha }} + repository: ${{ github.event.pull_request.head.repo.full_name }} - name: Run cpp-linter uses: cpp-linter/cpp-linter-action@b6edc0625e3941baa1797f4b4326adeab6890c97 # v2.16.7 From dbb26a56433b4b2ed17e5fc5b5b3f5c809f61d5f Mon Sep 17 00:00:00 2001 From: Denis Arnst Date: Thu, 22 Jan 2026 16:09:03 +0100 Subject: [PATCH 2/2] Update clang-format.yml --- .github/workflows/clang-format.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index 2d8961c4..42baba26 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -16,6 +16,9 @@ jobs: contents: read pull-requests: write steps: + # Security note: Checking out fork code with pull_request_target is safe here + # because clang-format only parses source files for formatting, it does not + # execute any code. No build scripts or PR code are run. - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0