build1 distinct publisher
Checkout v7 warns and exits rather than clone fork code under pull_request_target
For anyone running pull_request_target, pinning v7 starts with a workflow audit rather than a version bump, and the credential relocation underneath it carries a runner version floor that self-hosted fleets should check first.
Publishers:dev.to
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+35
- Incentives55