fix: add allow-unsafe-pr-checkout: true to checkout steps

When checking out from fork repos, the allow-unsafe-pr-checkout option
must be set to true to allow actions/checkout to fetch from the fork
repository.

Author: hudeng-go

.github/workflows/auto-tag.yml

@@ -20,6 +20,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           persist-credentials: false
       - name: get changelog version
         id: get-version

.github/workflows/build-distribution.yml

@@ -27,6 +27,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -68,6 +69,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -164,6 +166,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:
@@ -369,6 +372,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
         with:

.github/workflows/commitlint.yml

@@ -11,6 +11,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           fetch-depth: 0
 
       - name: check PR description for AI co-author pattern

.github/workflows/doc-check.yml

@@ -61,6 +61,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
           persist-credentials: false
 
       - uses: linuxdeepin/action-doxygencheck@master

.github/workflows/dtk-unittest.yml

@@ -25,6 +25,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: actions/checkout@v7
         if: ${{ github.event_name == 'push' }}
 

.github/workflows/license-check.yml

@@ -11,6 +11,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
 
       - name: Setup Python
         id: python
@@ -118,6 +119,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - name: Install zsh
         run: |
           sudo sed -i 's/azure.archive.ubuntu.com/mirrors.layeronline.com/g' /etc/apt/sources.list
@@ -150,6 +152,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - uses: zccrs/github-actions-spdx-checker@main
         with:
           include: '*.py,*.js,*.jsx,*.tsx,*.java,*.cpp,*.c,*.h,*.hpp,*.go,*.rs,*.rb,*.php,*.sh,*.xml,*.yaml,*.yml,*.qml,CMakeLists.txt,Makefile'