fix(ci): allow checkout v6 for PR heads

Explicitly allow the 11 pull_request_target checkout steps that intentionally check out fork head SHAs under checkout v6.1. Disable credential persistence for the same untrusted working trees while preserving the existing runner, cache, container, permission, and Guix behavior.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: thepastaclaw

.github/workflows/build-container.yml

@@ -41,6 +41,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -85,6 +87,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -128,6 +132,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/build-depends.yml

@@ -52,6 +52,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           sparse-checkout: |
             ci/dash
             ci/test
@@ -134,6 +136,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Restore depends sources
         uses: actions/cache/restore@v5

.github/workflows/build-src.yml

@@ -57,6 +57,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup

.github/workflows/cache-depends-sources.yml

@@ -23,6 +23,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Check for cached sources
         id: cache-check

.github/workflows/guix-build.yml

@@ -28,6 +28,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 
@@ -87,6 +89,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 

.github/workflows/lint.yml

@@ -24,6 +24,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup

.github/workflows/test-src.yml

@@ -36,6 +36,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 1
 
       - name: Download build artifacts