From ea8ccac960ab73f8767c8bce494ad530f4f537ae Mon Sep 17 00:00:00 2001
From: Yevhen Stepanenko <yevhen.s@mate.academy>
Date: Tue, 21 Jul 2026 13:27:42 +0300
Subject: [PATCH 1/2] [CI]: Fix fork-PR checkout blocked by security guard,
 keep auto-approve/reject

---
 .github/workflows/pr-review.yml | 40 +++++++++++++++++++++++++++++++++
 .github/workflows/test.yml      | 18 +++++++++++----
 2 files changed, 54 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/pr-review.yml

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
new file mode 100644
index 000000000..5c55ed522
--- /dev/null
+++ b/.github/workflows/pr-review.yml
@@ -0,0 +1,40 @@
+name: PR Review
+
+on:
+  workflow_run:
+    workflows: [Test]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  actions: read
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.event == 'pull_request' }}
+
+    steps:
+      - name: Download PR number
+        uses: actions/download-artifact@v4
+        with:
+          name: pr-number
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Read PR number
+        id: pr
+        run: echo "number=$(cat pr-number.txt)" >> "$GITHUB_OUTPUT"
+
+      - uses: mate-academy/auto-approve-action@v2
+        if: ${{ github.event.workflow_run.conclusion == 'success' }}
+        with:
+          github-token: ${{ github.token }}
+          pull-request-number: ${{ steps.pr.outputs.number }}
+
+      - uses: mate-academy/auto-reject-action@v2
+        if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+        with:
+          github-token: ${{ github.token }}
+          pull-request-number: ${{ steps.pr.outputs.number }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1b68d565d..7dcedc658 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,6 +1,8 @@
 name: Test
 
-on: [push, pull_request_target]
+on:
+  push:
+  pull_request:
 
 jobs:
   test:
@@ -9,9 +11,6 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v2
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Set Up Python 3.14
         uses: actions/setup-python@v2
@@ -31,3 +30,14 @@ jobs:
       - name: Run mentor tests
         timeout-minutes: 5
         run: pytest --numprocesses=auto tests/
+
+      - name: Save PR number
+        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
+        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
+
+      - name: Upload PR number
+        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-number
+          path: pr-number.txt

From 78fde32706b7a8833e81e56b59e848b765231720 Mon Sep 17 00:00:00 2001
From: Yevhen Stepanenko <yevhen.s@mate.academy>
Date: Tue, 21 Jul 2026 13:30:01 +0300
Subject: [PATCH 2/2] Drop review workflow: this task had no
 auto-approve/reject to preserve

---
 .github/workflows/pr-review.yml | 40 ---------------------------------
 .github/workflows/test.yml      | 11 ---------
 2 files changed, 51 deletions(-)
 delete mode 100644 .github/workflows/pr-review.yml

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
deleted file mode 100644
index 5c55ed522..000000000
--- a/.github/workflows/pr-review.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: PR Review
-
-on:
-  workflow_run:
-    workflows: [Test]
-    types: [completed]
-
-permissions:
-  pull-requests: write
-  actions: read
-  contents: read
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.event == 'pull_request' }}
-
-    steps:
-      - name: Download PR number
-        uses: actions/download-artifact@v4
-        with:
-          name: pr-number
-          run-id: ${{ github.event.workflow_run.id }}
-          github-token: ${{ github.token }}
-
-      - name: Read PR number
-        id: pr
-        run: echo "number=$(cat pr-number.txt)" >> "$GITHUB_OUTPUT"
-
-      - uses: mate-academy/auto-approve-action@v2
-        if: ${{ github.event.workflow_run.conclusion == 'success' }}
-        with:
-          github-token: ${{ github.token }}
-          pull-request-number: ${{ steps.pr.outputs.number }}
-
-      - uses: mate-academy/auto-reject-action@v2
-        if: ${{ github.event.workflow_run.conclusion == 'failure' }}
-        with:
-          github-token: ${{ github.token }}
-          pull-request-number: ${{ steps.pr.outputs.number }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7dcedc658..80de4bcca 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -30,14 +30,3 @@ jobs:
       - name: Run mentor tests
         timeout-minutes: 5
         run: pytest --numprocesses=auto tests/
-
-      - name: Save PR number
-        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
-
-      - name: Upload PR number
-        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: pr-number
-          path: pr-number.txt