workflows/pr-severity: use pull_request_target for fork PRs
What the developer wrote
Authored by Olaoluwa Osuntokun
workflows/pr-severity: use pull_request_target for fork PRs
Switch from pull_request to pull_request_target to allow the workflow
to run on PRs from forks. The pull_request trigger runs in the fork's
context which cannot access repository secrets.
This is safe because the workflow only reads PR metadata via the GitHub
API (changed files, labels) and doesn't checkout or execute any code
from the PR itself.
What changed, and why it matters
This commit changes a GitHub Actions workflow so it can run on pull requests submitted from outside forks. The change is intentional and the commit message explains why it is considered safe: the workflow only reads information about the pull request (like labels and changed files) and never downloads or runs code from the contributor's fork. There is no vulnerability in the diff itself.
No action required for this commit. As a general hardening measure, maintainers should periodically audit the pr-severity workflow to confirm it does not later add steps that check out or execute code from the PR, and ensure the `permissions:` block remains minimal.
Security signals we found
Workflow trigger changed to pull_request_target, which is a known high-risk event when combined with checkout/run of PR code
Commit message explicitly addresses the safety rationale and limits operations to PR metadata reads
Evidence from the diff
The workflow trigger is switched from pull_request to pull_request_target. The pull_request_target event runs in the base repository’s context and has access to secrets, which is why it is risky if combined with checking out or executing untrusted PR code. Here, the workflow only queries GitHub API metadata (changed files, labels), so the change is a deliberate, documented configuration update rather than a security defect. No code execution, checkout, or secret-exfiltration behavior is introduced by the patch.
Changed components
.github/workflows/pr-severity.ymlInspect captured patch +4 / −1
diff --git a/.github/workflows/pr-severity.yml b/.github/workflows/pr-severity.yml
index b8cbd3a..cfce023 100644
--- a/.github/workflows/pr-severity.yml
+++ b/.github/workflows/pr-severity.yml
@@ -1,7 +1,10 @@
name: PR Severity Classification
on:
- pull_request:
+ # Use pull_request_target to allow running on fork PRs with access to secrets.
+ # This is safe because we don't checkout or execute any code from the PR -
+ # we only read PR metadata (changed files, labels) via the GitHub API.
+ pull_request_target:
types: [opened, synchronize, labeled]
permissions:
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.