weboko 6227b861e1 ci: fetch submission files instead of checking out the fork ...

actions/checkout v4.4.0 refuses to check out fork PR code from a
pull_request_target workflow, so every submission PR from a fork now dies
at the checkout step and the validator never runs.

Rather than opt back in with allow-unsafe-pr-checkout, drop the fork
checkout entirely. The validator reads exactly one thing from the PR --
the submission markdown -- so those blobs are fetched by path from the
contents API instead. The fork's working tree never lands on the runner,
which removes the pwn-request exposure the guard exists for rather than
declaring it acceptable, and leaves nothing to re-audit when this job
grows a build or lint step later.

Also:
- Read the prize spec from base/ rather than the PR. It is repo-owned, so
  the base branch's copy is authoritative; the fork's is a stale snapshot
  from whenever it branched, which also made the closed/draft check read
  outdated status.
- persist-credentials: false on the base checkout. Nothing here pushes.
- Bound the submitter-supplied external clone and the one full-content
  scan of it with timeouts, no submodules, and no auth prompts.

2026-07-31 21:28:36 +02:00

..

validate-submission.yml

ci: fetch submission files instead of checking out the fork

2026-07-31 21:28:36 +02:00