From 9a5135ce3a3d26c4eca4c59cdd43b9dc688f235d Mon Sep 17 00:00:00 2001 From: ai-hpc Date: Mon, 18 May 2026 17:59:43 +1000 Subject: [PATCH] ci(contribution): switch trigger to pull_request_target MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The original `pull_request` trigger meant the workflow only ran when the PR's head branch contained the workflow file. PRs opened before the contribution-checklist landed (#78, #83, #87, ...) therefore didn't get the check — total stayed at 5 instead of 6. `pull_request_target` runs the workflow from the base branch's copy of this file, so the check fires regardless of when the PR head was branched. Safe here because the job only reads `github.event.pull_request.body` from the event payload — it never checks out or executes PR-controlled code, so the standard pull_request_target security caveat (untrusted code with secret access) doesn't apply. --- .github/workflows/contribution.yml | 10 +++++++++- CHANGELOG.md | 5 ++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/contribution.yml b/.github/workflows/contribution.yml index 27e1b701..59c8865c 100644 --- a/.github/workflows/contribution.yml +++ b/.github/workflows/contribution.yml @@ -5,10 +5,18 @@ # The check is intentionally lightweight: it confirms structure, not content # quality. Reviewers still have to read what you wrote and decide whether the # verification path is reasonable for the change. +# +# `pull_request_target` (not `pull_request`) so the workflow runs from the +# base branch's copy of this file — that way the check fires on every PR +# regardless of whether the PR head was branched before this workflow +# existed. Safe because the job only reads `github.event.pull_request.body` +# from the event payload; it never checks out or executes PR-controlled code. +# (The standard `pull_request_target` security caveat is about running +# untrusted PR code with secret access. We do neither.) name: Contribution on: - pull_request: + pull_request_target: types: [opened, edited, synchronize, reopened] branches: [main] diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ebc3ff6..eb38930e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,10 @@ - `CONTRIBUTING.md`, `SECURITY.md`, `.github/PULL_REQUEST_TEMPLATE.md`, and `.github/workflows/contribution.yml` — formal contribution guide + private-disclosure security policy + PR template + - `Contribution / PR body checklist` CI job. Quality / engineering / + `Contribution / PR body checklist` CI job (triggered via + `pull_request_target` so the check runs from the base branch's + workflow definition — fires on every PR regardless of whether the + PR head pre-dates the workflow). Quality / engineering / bug-fix contributions are explicitly welcomed; every PR must include a `## Real Behavior Proof` section in the body (CI enforces structure, reviewer reads the content) so reviewers can see what was actually