OB1 PR Gate fails on every fork PR: pull_request_target checkout refused

[jaredirish]

Which contribution?

Not a contribution bug — this is in .github/workflows/ob1-gate-v2.yml (the "OB1 PR Gate" / "OB1 Review" job), affecting the automated review for every fork-originated PR.

What happened?

The OB1 Review job checks out PR head code like this:

review:
  name: OB1 Review
  if: github.event_name == 'pull_request_target'
  runs-on: ubuntu-latest
  steps:
    - name: Checkout PR head safely
      uses: actions/checkout@v4
      with:
        ref: refs/pull/${{ github.event.pull_request.number }}/head
        fetch-depth: 0

Because the workflow trigger is pull_request_target, this checkout step runs with the base repo's GITHUB_TOKEN, secrets, and default-branch cache scope. GitHub Actions refuses to check out a fork's ref in that trusted context unless the step explicitly opts in with allow-unsafe-pr-checkout: true (this is the "pwn request" guard). Without that flag, the step errors immediately:

##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow.
This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache
scope, and runner access. Fetching and executing a fork's code in that trusted context
commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at
https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true'
on the actions/checkout step.

Since pull_request_target + fork checkout is exactly this shape on every fork PR, the OB1 Review check fails immediately (Set up job succeeds, checkout errors, "Upload gate artifact" warns no files found) regardless of what the PR actually contains. Reproduced on #481, a fork PR touching only recipes/panning-for-gold/*.

What did you expect?

The automated contribution review (metadata schema validation, scope check, credential scan, etc.) to actually run against the PR's changed files and report pass/fail on their merits, per CONTRIBUTING.md's "Automated Review Rules."

Steps to reproduce

1. Fork the repo.
2. Open a PR from the fork against main that touches any recipes/, skills/, etc. path.
3. Watch the "OB1 PR Gate" / "OB1 Review" check.
4. It fails at the "Checkout PR head safely" step with the message above, before any of the actual review logic runs.

Environment

• Observed on PR [recipes] panning-for-gold: update to v3.0.0 #481 (jaredirish:recipes/panning-for-gold-v3 → main)
• actions/checkout@v4, pull_request_target trigger, no allow-unsafe-pr-checkout set

Why this matters

As configured, OB1 Review can't currently pass on any external contributor's fork PR — only on PRs from branches within the base repo itself, which somewhat defeats the point of a public automated contribution gate. Since the checkout is only reading files to validate (not executing untrusted code), the standard safe pattern is either:

• Split into two workflows: an untrusted pull_request workflow that runs actions/checkout@v4 normally (default token, no secrets) to do the read-only validation, and a separate trusted pull_request_target workflow (if anything here genuinely needs write access or secrets) that does NOT check out fork code directly; or
• If write access to the PR (labels, comments) is required from the same job, keep pull_request_target for that but checkout with actions/checkout@v4's ref: refs/pull/N/merge (or explicit fork SHA) at a reduced permissions level and treat the checked-out code as untrusted (no execution of anything from the fork, read-only validation only) — which is effectively what allow-unsafe-pr-checkout: true documents as the informed opt-in for.

Happy to help test a fix if useful.