Increase retry attempts and allow unsafe PR checkout in workflows

[homotechsual]

This pull request introduces improvements to the GitHub Actions workflows to enhance reliability and security when running jobs. The most important changes are grouped as follows:

Workflow Reliability Improvements:

• Added a retries: 3 parameter to the actions/github-script@v9 step in .github/workflows/create-plugin-pr.yml to automatically retry the script up to three times in case of transient failures.

Security and Workflow Configuration:

• Set persist-credentials: false and enabled allow-unsafe-pr-checkout: true in the actions/checkout@v4 step of .github/workflows/publish.yml. This ensures credentials are not persisted for subsequent steps and explicitly allows checkouts from forked pull requests, but only after a maintainer review (as gated by the workflow's label and condition).

[github-actions]

⚡ Successfully deployed to Cloudflare Pages!

• 🔨 Latest commit: a265e00eca6c6426cdb260bb577f0ee2fe4941fa
• 🔍 Latest deploy log: https://github.com/DocusaurusCommunity/website/actions/runs/35106760440
• 😎 Deploy preview URL: https://head.docusauruscommunitywebsite.pages.dev
• 🌳 Environment: preview

[Copilot]

🟡 Changes recommended

The publishing workflow can execute fork-controlled code with deployment secrets, and its label guard is not exact.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR improves workflow retries and configures fork PR checkout behavior for publishing.

Changes:

• Adds three retries to the GitHub Script workflow step.
• Disables persisted checkout credentials and enables unsafe PR checkout.

File summaries

File	Summary
.github/workflows/publish.yml	Critical security concern with executing fork-controlled code using deployment secrets; moderate concern with non-exact label matching.
.github/workflows/create-plugin-pr.yml	Adds retries to GitHub Script operations.

Review details

Suppressed comments (2)

.github/workflows/publish.yml:75

• This opts the job into executing fork-controlled code under pull_request_target, so the label gate must be exact. The job condition currently uses contains(github.event.label.name, '🚀request-deploy'); a similarly named label such as 🚀request-deploy-preview would therefore reach this unsafe checkout and the subsequent Cloudflare-token deployment even though the maintainer did not apply the documented label. Require exact equality in the guard (and keep the cleanup condition consistent), or at minimum make this opt-in expression exact as a defense-in-depth check.

          allow-unsafe-pr-checkout: true

.github/workflows/publish.yml:75

• These lines claim the label is explicitly added by a maintainer, but the job condition only checks the label name and fork status; it never verifies who added the label or that the actor has maintainer-level permission. Because this pull_request_target job then checks out and executes the fork with Cloudflare/GitHub credentials, a lower-privilege collaborator who can apply labels could run untrusted code with those secrets. Enforce maintainer approval (for example with an environment requiring reviewers or an explicit permission check) before enabling this checkout.

          # Deploy from fork PRs only runs after a maintainer explicitly adds the
          # '🚀request-deploy' label (gated by the job's `if` condition above), so
          # opting in to fork checkout here is an intentional, reviewed trust boundary.
          allow-unsafe-pr-checkout: true

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.