From 99ac1898affab2a069cfa68dc15c33b863c8f6cb Mon Sep 17 00:00:00 2001
From: Allison Truhlar <amtruhlar@gmail.com>
Date: Mon, 14 Sep 2026 13:55:38 -0400
Subject: [PATCH] fix: stop running fork PR code in tag-validation workflow

actions/checkout@v4 now refuses to check out fork PR code from a
pull_request_target workflow, which broke validation on every external
PR. Rather than opting into the unsafe checkout, check out the base
branch so the validator and its npm dependencies always come from
trusted code, then fetch the PR merge ref and copy in only the changed
markdown files.

This also replaces tj-actions/changed-files with a git diff, since the
file list is now computed from the fetched merge ref.
---
 .github/workflows/tag-validation.yml | 36 ++++++++++++++--------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/tag-validation.yml b/.github/workflows/tag-validation.yml
index 72c63587..b452b343 100644
--- a/.github/workflows/tag-validation.yml
+++ b/.github/workflows/tag-validation.yml
@@ -12,27 +12,27 @@ jobs:
       pull-requests: write
 
     steps:
-      - name: Checkout PR
-        if: ${{ github.event.pull_request.number }}
+      # Checkout the base branch so all scripts run from trusted code.
+      # Only the changed markdown files are taken from the PR.
+      - name: Checkout base
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
 
-      - name: Get all changed markdown files
+      - name: Get changed markdown files from PR
         id: changed-markdown-files
-        uses: tj-actions/changed-files@v44
-        with:
-          files: |
-            **.md
-            **.mdx
-          files_ignore: |
-            _project-template.md
-            tagsList.md
-            README.md
-            CONTRIBUTING.md
-            LICENSE-3-clause-BSD.md
-            LICENSE-MIT.md
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          git fetch --no-tags origin "pull/${PR_NUMBER}/merge"
+          # Merge commit's first parent is the base branch tip.
+          changed=$(git diff --name-only --diff-filter=AM FETCH_HEAD^1 FETCH_HEAD -- '*.md' '*.mdx' \
+            | grep -v -E '(^|/)(_project-template\.md|tagsList\.md|README\.md|CONTRIBUTING\.md|LICENSE-3-clause-BSD\.md|LICENSE-MIT\.md)$' || true)
+          if [ -n "$changed" ]; then
+            echo "$changed" | xargs git checkout FETCH_HEAD --
+            echo "any_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "any_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "all_changed_files=$(echo $changed | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
 
       - name: List all changed files markdown files
         if: steps.changed-markdown-files.outputs.any_changed == 'true'