fix(docs): fork checkout needs allow-unsafe-pr-checkout, and an honest skip message

[shenxianpeng]

Why this is a separate PR

These three fixes were pushed to #279 while it was being merged, so the squash took 0db5e82 and left them behind. They apply to docs/fork-pr-comments.md and the fork skip message that #279 introduced.

What

The documented pull_request_target fallback cannot work as written

actions/checkout added an allow-unsafe-pr-checkout input (v4.4.0, present in v7.0.1) that defaults to false and blocks checking out fork pull-request code from a pull_request_target or workflow_run job. The example in #279 omits it, so checkout stops and the workflow never reaches commit-check/commit-check-action@v2.

Verified against the source rather than taken on trust — raw.githubusercontent.com/actions/checkout/v7.0.1/action.yml:

allow-unsafe-pr-checkout:
  description: >
    Required to check out fork pull request code from a workflow triggered by
    `pull_request_target` or `workflow_run`. These workflows run with the
    base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
    runner access; fetching and executing a fork's code in that trusted
    context commonly leads to "pwn request" vulnerabilities. …
  default: false

The input is now in the example, and the warning beside it is rewritten around what checkout itself says: this is the "pwn request" shape, the input is the switch that makes you acknowledge it, the job holds the base repository's token, secrets, cache scope and runner, and the checkout puts the fork's code on that runner. The link now points at GitHub's own Securely using pull_request_target instead of a third-party write-up.

The fork skip message promised a job summary that may not exist

With job-summary: false no summary is written, but the warning still sent the reader to one. It now names the annotations alone in that case, and both surfaces when the summary is enabled.

where = "in the annotations on the Files changed tab"
if JOB_SUMMARY_ENABLED and GITHUB_STEP_SUMMARY:
    where = f"in this job's summary and {where}"

A test pins both wordings and asserts no summary file is created in the disabled case. Reverting the condition to the previous unconditional text makes it fail, which is how I checked it actually covers the change.

MD040

The log excerpt in the docs gets a text language tag.

Verification

• pytest: 194 passed, 8 subtests. pre-commit run --all-files clean.
• The doc's YAML example parses and carries allow-unsafe-pr-checkout: true.
• Both opening fences in the page now carry a language tag.

🤖 Generated with Claude Code

https://claude.ai/code/session_018xYa7m3qup5wyN5MaXFgf6

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: cd04c4dc-f7cf-4cb3-8a36-943a23cd0296

📥 Commits

Reviewing files that changed from the base of the PR and between a793898 and 8bcf9ce.

📒 Files selected for processing (3)

• docs/fork-pr-comments.md
• main.py
• main_test.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Commit Check

✅ All 5 checks passed

Show all 5 checks

Commit message
  ✔ PR title (fix(docs): fork checkout needs allow-unsafe-pr-checkout, ...)
  ✔ Commit 1/1 (8bcf9ce) (fix(docs): fork checkout needs allow-unsafe-pr-checkout; ...)
Branch
  ✔ Branch (claude/submit-patch-commit-check-42ac3i)
Author
  ✔ Author name (Xianpeng Shen)
  ✔ Author email (xianpeng.shen@gmail.com)

commit-check 2.17.0 · Rules reference

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.01%. Comparing base (a793898) to head (8bcf9ce).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #280      +/-   ##
==========================================
+ Coverage   94.99%   95.01%   +0.02%     
==========================================
  Files           1        1              
  Lines         599      602       +3     
==========================================
+ Hits          569      572       +3     
  Misses         30       30              

Flag	Coverage Δ
unittests	95.01% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.