Branch: refs/heads/master Home: https://github.com/xwiki/.github Commit: 302a047b2a23fd0bfc9859527ec4c68c2daceb23 https://github.com/xwiki/.github/commit/302a047b2a23fd0bfc9859527ec4c68c2dac... Author: Vincent Massol <[email protected]> Date: 2026-08-28 (Fri, 28 Aug 2026) Changed paths: M .github/workflows/quality-pr.yml M README.md Log Message: ----------- [Misc] Check Checkstyle on the pull requests coming from a fork * Split the two checks the shared quality workflow runs, which cannot reach the same pull requests: Checkstyle is a verdict the build gives with no credentials involved, so it can be checked on a fork, whereas the SonarQube half needs a token that must only ever be released to code whose author could have pushed it into the repository themselves, Maven executing whatever a pull request's own poms tell it to. * Add the sonar input saying which half a call runs and the ref input saying what to check out, and make SONAR_TOKEN optional, a run doing Checkstyle alone being precisely a run that was given no token. * Check out with persist-credentials false: a pull_request_target run is handed a writable GITHUB_TOKEN, which has no business surviving into the build that follows it. * Leave the dependency bots out of both halves: a version bump writes no line either check has an opinion on, and those pull requests are numerous enough to be most of what this would spend. * Document the three cases, the two stubs calling this workflow and the consequences of pull_request_target in the README. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/.github/settings/notifications