.github/workflows: switch to pull_request_target trigger

Switch the trigger from `pull_request` to `pull_request_target` so that
the workflow definition on `main` is evaluated for PRs targeting active
release branches (main, umbrella, tentacle, squid). This allows the check
to run cleanly across release branches without requiring workflow file
backports to each branch.

While this workflow passes `github.token`, the token permissions are
strictly restricted to read-only (`contents: read` and `pull-requests: read`).
Because no PR code is checked out or executed, using `pull_request_target`
presents zero security risk here.

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>

diff --git a/.github/workflows/check-license.yml b/.github/workflows/check-license.yml
index 9dc48b6aa302a25c5ee50b8e5bd57950658bde9d..b40394e049abcea0099b0868622749361574b72a 100644 (file)
--- a/.github/workflows/check-license.yml
+++ b/.github/workflows/check-license.yml
@@ -1,6 +1,12 @@
 ---
 name: "Check for Incompatible Licenses"
-on: [pull_request]
+on:
+  pull_request_target:
+    branches:
+      - main
+      - umbrella
+      - tentacle
+      - squid
 
 permissions:
   contents: read