The fork e2e lane fails for every fork pull request since actions/checkout moved to v4.4.0, so the required "E2E Tests" status goes red on all of them no matter what they change.
The Push fork images + packages artifact job in e2e-fork.yaml stops at its first checkout:
Refusing to check out fork pull request code from a 'workflow_run' workflow. [...] To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.
The break lines up with the checkout bump. v4.4.0 added allow-unsafe-pr-checkout, default false, and #4447 moved the workflow from v4.3.1 to v4.4.0 on 2026-09-26. The last publish jobs that passed ran on 2026-09-25 at 20:18 and 20:30 UTC. Every one that ran after the merge failed with the message above. #4493 and #4494 are approved and blocked on it right now.
The lane already takes fork code on purpose: publish runs no fork-authored script and e2e holds no push token, as the workflow header describes. Setting the opt-in on both pull-request checkouts gives back the v4.3.1 behaviour.
The fork e2e lane fails for every fork pull request since actions/checkout moved to v4.4.0, so the required "E2E Tests" status goes red on all of them no matter what they change.
The
Push fork images + packages artifactjob ine2e-fork.yamlstops at its first checkout:The break lines up with the checkout bump. v4.4.0 added
allow-unsafe-pr-checkout, defaultfalse, and #4447 moved the workflow from v4.3.1 to v4.4.0 on 2026-09-26. The last publish jobs that passed ran on 2026-09-25 at 20:18 and 20:30 UTC. Every one that ran after the merge failed with the message above. #4493 and #4494 are approved and blocked on it right now.The lane already takes fork code on purpose:
publishruns no fork-authored script ande2eholds no push token, as the workflow header describes. Setting the opt-in on both pull-request checkouts gives back the v4.3.1 behaviour.