✅ Deploy Preview for cedarjs canceled.

Greptile Summary

This PR adds detailed inline comments to .github/workflows/require-milestone.yml explaining why pull_request_target is used and how it is kept secure, motivated by a supply-chain security audit after the TanStack npm compromise. No workflow logic, steps, or permissions were changed.

• pull_request routing: comments clarify that same-repo PRs use the PR branch's code so workflow changes can be tested before merging, with pull-requests: write being the narrowest permission needed.
• pull_request_target routing: comments document the two critical safety properties — the checkout never targets the fork's merge ref, and the local milestone action only reads PR metadata and calls the GitHub API (never executing fork-controlled code).
• Project overview doc (docs/implementation-docs/2026-03-26-cedarjs-project-overview.md) was reviewed per the repository owner's instruction and its contents remain factually accurate; this PR does not affect it.

Confidence Score: 5/5

This PR is safe to merge — it is a comment-only change with no modifications to workflow logic, permissions, or actions.

Only YAML comments were added or rewritten; the if: condition, permissions block, steps, and all action references are identical to the base branch. The security reasoning in the new comments accurately describes the existing workflow's safety properties.

No files require special attention.

Important Files Changed

_{Reviews (1): Last reviewed commit: "chore(ci): Explain usage of pull_request..." | Re-trigger Greptile}