pelikhan · Oct 3, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026
diff --git a/pkg/workflow/pr.go b/pkg/workflow/pr.go
@@ -2,6 +2,7 @@ package workflow
 
 import (
 	"fmt"
+	"path/filepath"
 	"sort"
 	"strings"
 
@@ -21,6 +22,17 @@ func ShouldGeneratePRCheckoutStep(data *WorkflowData) bool {
 	if data.CheckoutDisabled || data.IsPullRequestTarget {
 		return false
 	}
+	// checkout_pr_branch and the subsequent base-folder restore operate on the
+	// workspace root, so neither may run when it belongs to another repository.
+	for _, checkout := range data.CheckoutConfigs {
+		if checkout == nil || (filepath.Clean(checkout.Path) != "." && !strings.Contains(checkout.Path, "${{")) {
+			continue
+		}
+		repository := strings.TrimSpace(checkout.Repository)
+		if checkout.Wiki || (repository != "" && repository != "${{ github.repository }}") {
+			return false
+		}
+	}
 	if data.CachedPermissions != nil {
 		return data.CachedPermissions.HasContentsReadAccess()
 	}

diff --git a/pkg/workflow/pr_test.go b/pkg/workflow/pr_test.go
@@ -3,6 +3,8 @@
 package workflow
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -106,6 +108,106 @@ func TestShouldGeneratePRCheckoutStep_CheckoutDisabled(t *testing.T) {
 	})
 }
 
+func TestShouldGeneratePRCheckoutStep_MultiCheckout(t *testing.T) {
+	tests := []struct {
+		name      string
+		checkouts []*CheckoutConfig
+		want      bool
+	}{
+		{
+			name: "external repository at root and workflow repository in subpath",
+			checkouts: []*CheckoutConfig{
+				{Repository: "${{ inputs.target_repo }}", Path: "."},
+				{Repository: "${{ github.repository }}", Path: "target"},
+			},
+		},
+		{
+			name: "literal external repository at root",
+			checkouts: []*CheckoutConfig{
+				{Repository: "other/project", Path: ".", PathExplicit: true},
+			},
+		},
+		{
+			name: "wiki repository at root",
+			checkouts: []*CheckoutConfig{
+				{Repository: "${{ github.repository }}", Wiki: true},
+			},
+		},
+		{
+			name: "workflow repository at root and external repository in subpath",
+			checkouts: []*CheckoutConfig{
+				{Repository: "${{ github.repository }}", Path: "."},
+				{Repository: "other/project", Path: "target"},
+			},
+			want: true,
+		},
+		{
+			name: "implicit workflow repository at root",
+			checkouts: []*CheckoutConfig{
+				{Path: "."},
+				{Repository: "other/project", Path: "target"},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &WorkflowData{Permissions: "contents: read", CheckoutConfigs: tt.checkouts}
+			assert.Equal(t, tt.want, ShouldGeneratePRCheckoutStep(data))
+		})
+	}
+}
+
+func TestPRCheckoutRestoreWithMultiCheckout(t *testing.T) {
+	for _, tt := range []struct {
+		name       string
+		rootRepo   string
+		wantPRStep bool
+	}{
+		{name: "target repository at root", rootRepo: "${{ inputs.target_repo }}"},
+		{name: "workflow repository at root", rootRepo: "${{ github.repository }}", wantPRStep: true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			source := `---
+on:
+  workflow_dispatch:
+    inputs:
+      target_repo:
+        type: string
+        required: true
+permissions:
+  contents: read
+checkout:
+  - repository: ` + tt.rootRepo + `
+    path: .
+  - repository: ${{ github.repository }}
+    path: target
+strict: false
+---
+Test workflow.
+`
+			path := filepath.Join(dir, "test.md")
+			if err := os.WriteFile(path, []byte(source), 0644); err != nil {
+				t.Fatal(err)
+			}
+			if err := NewCompiler().CompileWorkflow(path); err != nil {
+				t.Fatal(err)
+			}
+			lock, err := os.ReadFile(filepath.Join(dir, "test.lock.yml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, step := range []string{
+				"- name: Checkout PR branch",
+				"- name: Restore agent config folders from base branch",
+			} {
+				assert.Equal(t, tt.wantPRStep, strings.Contains(string(lock), step), step)
+			}
+		})
+	}
+}
+
 func TestResolveAgentManifestPaths(t *testing.T) {
 	t.Run("includes defaults and only the selected engine", func(t *testing.T) {
 		folders, files := resolveAgentManifestPaths(NewEngineRegistry(), &WorkflowData{