From 9104e94fb36646bb0d82878bb2a7b4cd70ae8de8 Mon Sep 17 00:00:00 2001
From: Million <15158090088@163.com>
Date: Thu, 30 Jul 2026 14:33:06 +0800
Subject: [PATCH] fix(ci): allow-unsafe-pr-checkout for fork PR review

actions/checkout v6 refuses to checkout fork PR code in
pull_request_target workflows by default. Opt in since this
workflow only does checkout + AI review, never executes PR code.
---
 .github/workflows/opencode-review.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index 59355d586..baf825934 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -30,6 +30,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
           persist-credentials: false
+          allow-unsafe-pr-checkout: true
 
       - name: Run OpenCode review
         uses: anomalyco/opencode/github@latest
@@ -55,3 +56,4 @@ jobs:
             - Code: type safety, testing, telemetry, architecture consistency
             - Docs: AGENTS.md context loading table, subsystem AGENTS.md,
               docs/explanation/ coverage, link integrity
+