From f4495c64a7f7e4ef25389ce82e4460213e322d58 Mon Sep 17 00:00:00 2001 From: Mikey O'Toole Date: Sun, 23 Aug 2026 07:19:08 +0100 Subject: [PATCH 1/2] Increase retry attempts for GitHub script in create-plugin-pr workflow --- .github/workflows/create-plugin-pr.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/create-plugin-pr.yml b/.github/workflows/create-plugin-pr.yml index 3c71504..c864517 100644 --- a/.github/workflows/create-plugin-pr.yml +++ b/.github/workflows/create-plugin-pr.yml @@ -16,6 +16,7 @@ jobs: steps: - uses: actions/github-script@v9 with: + retries: 3 script: | const body = context.payload.issue.body ?? ''; const issueNumber = context.payload.issue.number; From a265e00eca6c6426cdb260bb577f0ee2fe4941fa Mon Sep 17 00:00:00 2001 From: Mikey O'Toole Date: Wed, 16 Sep 2026 15:00:37 +0100 Subject: [PATCH 2/2] Allow unsafe PR checkout for forked PRs in publish workflow --- .github/workflows/publish.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c03b5ee..20bc678 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -68,6 +68,11 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha || github.ref }} fetch-depth: 0 + persist-credentials: false + # Deploy from fork PRs only runs after a maintainer explicitly adds the + # '🚀request-deploy' label (gated by the job's `if` condition above), so + # opting in to fork checkout here is an intentional, reviewed trust boundary. + allow-unsafe-pr-checkout: true - name: Remove built-in Yarn run: npm uninstall -g yarn