From 0483d3e155dcc39e622c933af17e268e93b2597f Mon Sep 17 00:00:00 2001
From: Jade Ellis <jade@ellis.link>
Date: Sat, 27 Jun 2026 00:54:09 +0100
Subject: [PATCH] ci: Don't checkout repo in pull_request_target

---
 .forgejo/workflows/check-changelog.yml | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/check-changelog.yml b/.forgejo/workflows/check-changelog.yml
index fb21354aa..f4e0f8112 100644
--- a/.forgejo/workflows/check-changelog.yml
+++ b/.forgejo/workflows/check-changelog.yml
@@ -14,23 +14,19 @@ jobs:
     name: Check changelog is added
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-          sparse-checkout: .
-
       - name: Check for changelog entry
         id: check_files
         run: |
-          git fetch origin ${GITHUB_BASE_REF}
+          AUTH=$(echo -n "x-access-token:${{ secrets.GITHUB_TOKEN }}" | base64 -w 0)
+          git config --global http.${{ github.server_url }}/.extraheader "Authorization: basic $AUTH"
+          git clone "${{ github.event.repository.clone_url }}" repo.git --bare
+
+          git -C repo.git fetch origin ${{ github.event.pull_request.head.ref }}
 
           # Check for Added (A) or Modified (M) files in changelog.d
-          CHANGELOG_CHANGES=$(git diff --name-status origin/${GITHUB_BASE_REF}...HEAD -- changelog.d/)
+          CHANGELOG_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- changelog.d/)
 
-          SRC_CHANGES=$(git diff --name-status origin/${GITHUB_BASE_REF}...HEAD -- src/)
+          SRC_CHANGES=$(git -C repo.git diff --name-status ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} -- src/)
 
           echo "Changes in changelog.d/:"
           echo "$CHANGELOG_CHANGES"