🧰 actions/checkout

The items that name it 6

• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas tools2026-10-12It is written here as actions/checkout (pin to commit SHA, e.g. v6.0.2 tag is not pinned).

  pin to commit SHA, e.g. v6.0.2 tag is not pinned

• GitHub Action Canaries
  repoas tools2026-07-11

  Official GitHub Action used to check out repository code; referenced as the step that should precede the Tracebit action in async mode (commit de0fac2e4500dabe0009e67214ff5f5447ce83dd used in example)

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  articleas affected products2026-06-22

  GitHub Actions checkout action

• The complete GitHub Actions security checklist
  articleas affected products2026-05-11

  As of June 18, 2026, blocks common pwn request patterns by default in pull_request_target and workflow_run workflows, refusing to fetch fork PR code unless allow-unsafe-pr-checkout: true is set.

• GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
  articleas tools2026-04-14

  Official GitHub Action for fetching repository code

• Securely using pull_request_target - GitHub Enterprise Cloud Docs
  articleas tools

  GitHub Action to check out repository code in a workflow; behavior differs by triggering event and ref specified, includes allow-unsafe-pr-checkout input to opt out of fork pull request checkout protection