From 2eba0e030f84962607c1efd8d6cd914d57b5af5c Mon Sep 17 00:00:00 2001
From: Sebastiano Poggi <poggos@gmail.com>
Date: Fri, 21 Aug 2026 15:44:38 +0200
Subject: [PATCH] [JEWEL-1288] Run PR formalities from the base branch

The formalities job checked out the PR head and ran validation
scripts with GH_TOKEN and JEWEL_YT_TOKEN. A PR can replace those
scripts.

Checkout github.event.pull_request.base.sha instead, and only the
scripts tree. For the API-dump annotator, keep the PR dumps but
overlay the trusted scripts from the same base SHA.

closes https://github.com/JetBrains/intellij-community/pull/3626


(cherry picked from commit a0e0404eca96167e6121ca7876068b79a6a5b50d)

IJ-MR-220560

GitOrigin-RevId: 331a7e2e06704df8a11e3a211aea7b4030ab9cbd
---
 .github/workflows/jewel-checks.yml | 33 +++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/jewel-checks.yml b/.github/workflows/jewel-checks.yml
index 28c2beac8a8d..0bd8cca47bc2 100644
--- a/.github/workflows/jewel-checks.yml
+++ b/.github/workflows/jewel-checks.yml
@@ -85,12 +85,20 @@ jobs:
     runs-on: ubuntu-latest
     needs: check_paths
     if: needs.check_paths.outputs.run_formalities == 'true'
+    permissions:
+      contents: read
+      pull-requests: read
 
     steps:
-      - uses: actions/checkout@v4
+      # These scripts only need the PR number via the GitHub API. Checkout the
+      # base SHA so a PR cannot replace the validators that receive GH_TOKEN
+      # and JEWEL_YT_TOKEN (JEWEL-1288).
+      - uses: actions/checkout@v7.0.1
+        name: Check out base branch scripts only
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
-        name: Check out repository
+          ref: ${{ github.event.pull_request.base.sha }}
+          sparse-checkout: |
+            platform/jewel/scripts/
 
       - name: Grant execute permission to validation scripts
         run: chmod +x ./scripts/validate-commit-message.sh && chmod +x ./scripts/validate-pr-commits.sh
@@ -111,6 +119,9 @@ jobs:
   annotate_breaking_api_changes:
     name: Annotate breaking API changes with IJP dumps
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
 
     steps:
       - uses: actions/checkout@v4
@@ -119,6 +130,22 @@ jobs:
           fetch-depth: '2'
         name: Check out repository
 
+      # The job needs the PR's API dumps, but must run the trusted annotator
+      # with GH_TOKEN, not a replacement from the PR (JEWEL-1288).
+      - uses: actions/checkout@v7.0.1
+        name: Check out trusted CI scripts from the base branch
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          sparse-checkout: |
+            platform/jewel/scripts/
+          path: .trusted-base-scripts
+
+      - name: Overlay trusted CI scripts
+        working-directory: .
+        run: |
+          rm -rf platform/jewel/scripts
+          cp -a .trusted-base-scripts/platform/jewel/scripts platform/jewel/scripts
+
       - name: Set up Kotlin ${{ env.KOTLIN_VERSION }}
         id: kotlin
         uses: ./.github/actions/setup-kotlin