Skip to content

[CI] Review pull_request_target workflow triggers #49726

Closed as not planned
Closed as not planned

Description

@thisisnic

Describe the enhancement

Several workflows use pull_request_target as a trigger. This trigger runs in the context of the base branch and has access to secrets, which requires careful handling. These workflows should be reviewed to ensure they follow best practices.

Affected files

  • .github/workflows/dev_pr.yml
  • .github/workflows/pr_bot.yml
  • .github/workflows/pr_review_trigger.yml

Component(s)

Continuous Integration

Activity

  1. thisisnic commented on Apr 14, 2026

    @thisisnic
    MemberAuthor

    I think this one is a false positive as they all have persist-credentials set to false and check out the main branch only.

  2. raulcd commented on Apr 14, 2026

    @raulcd
    Member

    I agree. Thanks @thisisnic for taking a look into those!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions