Merge f16eddee8410930a20309c41063631c4177643a5 into 11bd71901bbe5b1630ceea73d27597364c9af683

Update README.md
2025-06-07 17:48:45 +08:00 · 2024-11-06 11:26:22 +00:00 · 2020-09-15 04:37:09 +09:00 · 2020-08-09 21:59:31 +09:00 · 2020-08-09 21:54:36 +09:00
1 changed files with 17 additions and 0 deletions
--- a/README.md
+++ b/README.md
@ -142,6 +142,7 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
 - [Checkout multiple repos (private)](#Checkout-multiple-repos-private)
 - [Checkout pull request HEAD commit instead of merge commit](#Checkout-pull-request-HEAD-commit-instead-of-merge-commit)
 - [Checkout pull request on closed event](#Checkout-pull-request-on-closed-event)
+- [Checkout pull request on `pull_request_target`](#Checkout-pull-request-on-pull_request_target)
 - [Push a commit using the built-in token](#Push-a-commit-using-the-built-in-token)

 ## Fetch only the root files
@ -268,6 +269,22 @@ jobs:
      - uses: actions/checkout@v4
 ```

+## Checkout pull request on `pull_request_target`
+
+```yaml
+on:
+  - pull_request_target
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+```
+
+**WARNING! NEVER** run code from pull requests of public repositories! The token of `pull_request_target` event has write access.
+
 ## Push a commit using the built-in token

 ```yaml
Author	SHA1	Message	Date
ylemkimon	80f21e272e	Merge f16eddee8410930a20309c41063631c4177643a5 into 11bd71901bbe5b1630ceea73d27597364c9af683	2024-11-06 11:26:22 +00:00
ylemkimon	f16eddee84	Update README.md	2020-09-15 04:37:09 +09:00
ylemkimon	4c4d2b5a39	Update README.md	2020-08-09 21:59:31 +09:00
ylemkimon	05aa1e5bb4	Update README regarding `pull_request_target`	2020-08-09 21:54:36 +09:00