From 71ddab8e3266459c28f6429a585ce8507aed30b4 Mon Sep 17 00:00:00 2001 From: Patrick Donnelly Date: Wed, 29 Jul 2026 20:43:02 -0400 Subject: [PATCH] .github/workflows: switch to pull_request_target trigger Switch the trigger from `pull_request` to `pull_request_target` so that the workflow definition on `main` is evaluated for PRs targeting active release branches (main, umbrella, tentacle, squid). This allows the check to run cleanly across release branches without requiring workflow file backports to each branch. While this workflow passes `github.token`, the token permissions are strictly restricted to read-only (`contents: read` and `pull-requests: read`). Because no PR code is checked out or executed, using `pull_request_target` presents zero security risk here. Signed-off-by: Patrick Donnelly --- .github/workflows/check-license.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-license.yml b/.github/workflows/check-license.yml index 9dc48b6aa302..b40394e049ab 100644 --- a/.github/workflows/check-license.yml +++ b/.github/workflows/check-license.yml @@ -1,6 +1,12 @@ --- name: "Check for Incompatible Licenses" -on: [pull_request] +on: + pull_request_target: + branches: + - main + - umbrella + - tentacle + - squid permissions: contents: read -- 2.47.3