ci: backend-unit-nightly runs fork-PR code in a main-scoped job with a shared pip cache and a verdict bot that trusts fork-produced JSON (CSO 2026-09-29 #2) #3103

Summary

.github/workflows/backend-unit-nightly.yml enumerates open PRs against dev with gh pr list … --json number,headRefName,headRefOid (L74-79) and has no isCrossRepository filter, unlike integration-nightly.yml L89-100 which drops fork PRs with a ::warning::. The schedule trigger runs in the main ref context, fetches pull/N/head, merges it, runs pip install -r tests/requirements-test.txt and pytest unit/ on the merged tree, and:

1. actions/setup-python with cache: 'pip' (L218-222) runs after the merge, keyed on the fork's tests/requirements-test.txt, and its post-step saves a main-scoped cache populated after fork code ran. That prefix is restored by the required checks (backend-unit-test.yml, schema-parity.yml, pg-migrations.yml).
2. The status JSON (L296-348) is written after fork code ran, and the comment job (pull-requests: write) trusts its pr_number (scripts/ci/nightly-verdict.js L66-69) and interpolates head_sha raw into the sticky comment (L534/536).

The pytest job correctly holds no secrets and uses persist-credentials: false, so direct token theft is excluded. The nightly also bypasses GitHub's first-contributor approve-and-run gate.

Acceptance criteria

• --json requests isCrossRepository and the matrix filters select(.isCrossRepository | not) with a visible warning for skipped forks (copy integration-nightly.yml L89-100).
• cache: 'pip' removed from the nightly test job so a scheduled main-scoped cache can never be produced from a post-merge tree.
• The comment job derives pr_number/seed from the artifact name, rejects JSON that disagrees, and validates head_sha against ^[0-9a-f]{40}$ before interpolation.
• A sibling of tests/unit/test_2767_issue_status_fork_prs.py pins the fork filter in both nightlies.

Evidence

docs/security-reports/cso-2026-09-29.md Finding 2.