permission_check fails on fork PRs before it checks anything (checkout v7 refuses the head ref)

Leggi prima init-svc-executable-permissions.yml, quindi confronta il passaggio checkout in docker-mod-builder.yml. Traccia il controllo dei permessi e l’approccio della git trees API descritti nell’issue; il lavoro è completato quando i controlli dei permessi di fork-head funzionano senza checkout non sicuri né modifiche alla sicurezza di pull_request_target, inclusi i casi fork e interni documentati.

init-svc-executable-permissions.yml fails on a fork pull request that touches run, finish, check or root/migrations/*. The job stops before any file is read, because actions/checkout@v7.0.1 refuses pull_request.head.sha in a pull_request_target workflow.

PR #190 shows it: https://github.com/linuxserver/docker-baseimage-selkies/actions/runs/33459741080/job/99707212121
The checkout step ends with:

##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

"Check Permissions" is then skipped and the job fails. On that head SHA (a5272e08) all 13 run/finish files are 100755, so the check would have passed.

The switch to checkout 7 reached v1 with 6c9815b8 on 2026-07-03; the first fork run after that is from 2026-07-06. Since then 45 fork-head runs across linuxserver have failed and 7 internal-head runs have passed. After the switch and before that first fork run, docker-sabnzbd run 28709064096 (2026-07-04) passed: **** All perms look good ****. Twelve open fork pull requests carry a red permission_check; three more are green from before the switch.

f3577570 pinned the step to the head SHA because the check needs the PR's own files. The file modes can be read without a checkout: the git trees API on the base repository reaches the fork head through refs/pull/N/head, so the job can flag any matching blob that is not 100755 without fetching fork code. At a5272e08 it returns truncated: false, 151 entries, 13 of them run/finish blobs, all 100755. That leaves pull_request_target and the pinned ref untouched, with no allow-unsafe-pr-checkout. The same checkout step sits in docker-mod-builder.yml, which handles CR_PAT and DOCKERPASS.