From 3a78ddd5b48518d13eb87bd04ca2b44a6c9270a8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 28 Jul 2026 13:21:57 +0000
Subject: [PATCH] security: document why PR head ref is intentionally absent in
 monorepo-pr-bridge

---
 .github/workflows/monorepo-pr-bridge.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/monorepo-pr-bridge.yml b/.github/workflows/monorepo-pr-bridge.yml
index a5ae3280..d72db0c4 100644
--- a/.github/workflows/monorepo-pr-bridge.yml
+++ b/.github/workflows/monorepo-pr-bridge.yml
@@ -49,6 +49,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # SECURITY: Do NOT add `ref: ${{ github.event.pull_request.head.sha }}` here.
+      # pull_request_target runs in the base-branch context with access to
+      # repository secrets. Checking out PR head code would allow any PR
+      # author's scripts (e.g. .github/scripts/bridge-public-pr-to-monorepo.mjs)
+      # to execute with OSS_SYNC_APP credentials, enabling exfiltration of or
+      # writes to inkeep/agents-private. Intentionally omitted; keep it that way.
       - name: Checkout public repo automation
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -120,6 +126,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      # SECURITY: Do NOT add `ref: ${{ github.event.pull_request.head.sha }}` here.
+      # Same rationale as the sync job above: pull_request_target runs in the
+      # base-branch context with access to repository secrets, so checking out
+      # PR head code here would allow any PR author's scripts to execute with
+      # OSS_SYNC_APP credentials. Intentionally omitted; keep it that way.
       - name: Checkout public repo automation
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with: