Wondering why the github checkout task is using wrong commit for PR triggered workflow

[johnpazzly]

### Select Topic Area

Question

Body

Here is my workflow trigger which is intended to run on PRs and check-ins to my develop, and master branch.

on:
  push:
    branches: [develop, master]
  pull_request_target:
    types: [opened, reopened, synchronize]

My Checkout task:

jobs:
  Test:
    runs-on: windows-latest
    steps:
    - uses: actions/checkout@v3 

When I open a PR against the develop branch, I expect the action to use the PR source branch for the build, instead it uses the latest version of the develop branch (and that doesn't include PR code). I can see this in the checkout logs. Am I doing something wrong with my logic?

Thank you!

[airtower-luna]

For pull_request_target the GITHUB_REF is the default branch, as mentioned in the docs. So that's expected behavior.

You can tell actions/checkout to retrieve something else, but that can get very dangerous in combination with pull_request_target, see: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ ⚠️

[johnpazzly]

So would pull_request trigger instead being what I am looking for?

https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request

It says GITHUB_REF = PR merge branch refs/pull/:prNumber/merge
as opposed to "PR BASE Branch"

Also, Thanks for the security link.

[airtower-luna]

The technical answer is "it depends on what you're looking for". 😉

If you want to run tests, linter, etc. on the PR, then yes, it's the right thing. That "PR merge branch" is a temporary merge, basically what you'd get after merging the PR. 🙂

[joelberkeley]

what you'd get after merging the PR

does this not assume that the PR is merged with a merge commit rather than rebased?

[airtower-luna]

In terms of Git history yes, in terms of code as of the resulting commit it shouldn't make a difference.

[joelberkeley]

on further reflection, even in terms of git history, the way it currently works makes more sense. Using the PR branch would give incorrect diffs, for example

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬