From 8072f8a6b5a0dcc09ed60213aa2b5be1cc4d3013 Mon Sep 17 00:00:00 2001 From: finalerock44 Date: Mon, 9 Nov 2026 17:17:13 +0000 Subject: [PATCH] ci: lint PR titles on pull_request instead of pull_request_target GitHub blocks pull_request_target by default in public repositories from 2026-12-02. The PR title check only reads the event payload, so it runs on pull_request, which also fires for fork PRs with a read-only token. --- .github/workflows/pr-title-lint.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml index e3f8cb8..d2f9a9d 100644 --- a/.github/workflows/pr-title-lint.yml +++ b/.github/workflows/pr-title-lint.yml @@ -5,10 +5,14 @@ name: PR Title # compute version bumps and the changelog — so the allowed types below must stay # in sync with `changelog-sections` in release-please-config.json. # -# Uses pull_request_target so it also runs (and reports a required status check) -# on PRs from forks. It only reads the title — no untrusted code is checked out. +# Runs on pull_request, which also fires for PRs from forks. Fork runs get a +# read-only token and no secrets, and that is all a title check needs: it reads +# the title from the event payload and checks out no code. It used to run on +# pull_request_target, which GitHub blocks by default in public repositories +# from 2026-12-02, so don't switch back. A first-time contributor's fork PR waits +# for a maintainer to approve the run before this check reports. on: - pull_request_target: + pull_request: types: - opened - edited