From 19ef2d18304cba1dfad984347002b40d6eea4a23 Mon Sep 17 00:00:00 2001
From: Ivan <oganin@gmail.com>
Date: Tue, 20 Oct 2026 13:36:12 +0300
Subject: [PATCH] Let the clang-tidy comment workflow check out fork pull
 requests

actions/checkout@v4 now needs allow-unsafe-pr-checkout for fork PR code in workflow_run.
---
 .github/workflows/post-static-analysis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/post-static-analysis.yml b/.github/workflows/post-static-analysis.yml
index 3ec7b001..94974d04 100644
--- a/.github/workflows/post-static-analysis.yml
+++ b/.github/workflows/post-static-analysis.yml
@@ -64,6 +64,8 @@ jobs:
         repository: ${{ env.PR_HEAD_REPO }}
         ref: ${{ env.PR_HEAD_SHA }}
         persist-credentials: false
+        # Only read by the comment action, never built or run.
+        allow-unsafe-pr-checkout: true
     - name: Redownload analysis results
       uses: actions/github-script@v7
       with: