.github/workflows/pr-checklist: switch to pull_request_target and scope permissions

To make `main` the authoritative workflow source.

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>

diff --git a/.github/workflows/pr-checklist.yml b/.github/workflows/pr-checklist.yml
index cf4b2b0a498c19d85517a232ddd6cbd528908b2a..325015622499ede1277ceab209e9ca6b3556c0d4 100644 (file)
--- a/.github/workflows/pr-checklist.yml
+++ b/.github/workflows/pr-checklist.yml
@@ -1,17 +1,22 @@
 ---
 name: "Pull Request Checklist"
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
     types:
       - edited
       - opened
       - reopened
+
+# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
+permissions:
+  pull-requests: read
+
 jobs:
   pr_checklist:
     runs-on: ubuntu-latest
-    name: Verify
+    name: Verify Checklist
     steps:
       - name: Sleep for 30 seconds
         run: sleep 30s