Unblock fork preview deploys by opting into secure fork checkout in pull_request_target

[Copilot]

Fork PR Preview started failing in the Deploy fork preview job after GitHub Actions enforced a new safety gate for fork checkouts in pull_request_target workflows. The workflow was attempting to checkout fork HEAD code without the required explicit opt-in.

• Root cause

  • actions/checkout@v4 now refuses fork PR checkout in pull_request_target unless allow-unsafe-pr-checkout is explicitly enabled.

• Workflow update

  • Updated .github/workflows/fork-preview.yml checkout step to opt in for this specific trusted preview flow.
  • Kept the change scoped to the single failing job path.

• Resulting behavior

  • Deploy fork preview can again fetch fork PR source (head.repo + head.sha) and proceed with build/upload/comment steps.

- name: Check out pull request
  uses: actions/checkout@v4
  with:
    repository: ${{ github.event.pull_request.head.repo.full_name }}
    ref: ${{ github.event.pull_request.head.sha }}
    allow-unsafe-pr-checkout: true

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	frcdesign	f1edb5c	Commit Preview URL Branch Preview URL	Aug 22 2026, 05:36 PM

[github-actions]

Cloudflare preview for this PR:

https://pr-354-frcdesign.frcdesign-org.workers.dev

This preview updates when the PR changes while the deploy-preview label remains present.