Relax approval gating for low-risk PR automations

.github/workflows/agentic_commands.yml

@@ -105,7 +105,7 @@ on:
     types: [edited, labeled, opened, reopened]
   issue_comment:
     types: [created, edited]
-  pull_request:
+  pull_request_target:
     types: [edited, labeled, opened, reopened]
   pull_request_review_comment:
     types: [created, edited]

.github/workflows/label-closed-prs.yml

@@ -2,7 +2,7 @@ name: Label Closed PRs
 
 # Trigger when a pull request is closed (either merged or without merging)
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
 
 permissions:

.github/workflows/pr-description-caveman.md

@@ -3,9 +3,13 @@ private: true
 name: PR Description Updater
 description: Rewrites a merged PR description with a structured, considered summary optimised for downstream agentic analysis. Processes the full diff in chunks using sub-agents. Ignores lock files and auto-generated code.
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
 if: github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/') && !startsWith(github.event.pull_request.head.ref, 'copilot/')
+checkout:
+  repository: ${{ github.repository }}
+  ref: ${{ github.event.pull_request.base.sha }}
+  fetch-depth: 0
 permissions:
   contents: read
   pull-requests: read

actions/setup/js/route_slash_command.cjs

@@ -43,6 +43,9 @@ async function appendRoutingSummary(existingCommands, selectedCommand) {
 }
 
 function eventIdentifier() {
+  if (context.eventName === "pull_request_target") {
+    return "pull_request";
+  }
   if (context.eventName !== "issue_comment") {
     return context.eventName;
   }
@@ -53,6 +56,7 @@ function resolveBodyText() {
   const bodyByEvent = {
     issues: context.payload?.issue?.body ?? "",
     pull_request: context.payload?.pull_request?.body ?? "",
+    pull_request_target: context.payload?.pull_request?.body ?? "",
     issue_comment: context.payload?.comment?.body ?? "",
     pull_request_review_comment: context.payload?.comment?.body ?? "",
     pull_request_review: context.payload?.review?.body ?? "",
@@ -215,7 +219,8 @@ async function addImmediateReaction(reaction) {
         });
         return;
       }
-      case "pull_request": {
+      case "pull_request":
+      case "pull_request_target": {
         const prNumber = context.payload?.pull_request?.number;
         if (!prNumber) {
           core.warning("Skipping immediate reaction: pull request number was not found in payload.");

actions/setup/js/route_slash_command.test.cjs

@@ -533,6 +533,19 @@ describe("route_slash_command", () => {
     expect(reactionCalls[0][0]).toBe("POST /repos/{owner}/{repo}/issues/{issue_number}/reactions");
   });
 
+  it("treats pull_request_target events as pull_request routes", async () => {
+    globals.context.eventName = "pull_request_target";
+    globals.context.payload = { pull_request: { number: 7, body: "/archie please" } };
+    process.env.GH_AW_SLASH_ROUTING = JSON.stringify({
+      archie: [{ workflow: "archie", events: ["pull_request"], ai_reaction: "eyes" }],
+    });
+    await main();
+    expect(dispatchCalls).toHaveLength(1);
+    expect(reactionCalls).toHaveLength(1);
+    const awContext = JSON.parse(dispatchCalls[0].inputs.aw_context);
+    expect(awContext.command_name).toBe("archie");
+  });
+
   it("adds immediate reaction for pull_request_review_comment events using comment id", async () => {
     globals.context.eventName = "pull_request_review_comment";
     globals.context.payload = { comment: { id: 99, body: "/archie please" } };

pkg/workflow/central_slash_command_workflow.go

@@ -734,7 +734,11 @@ func writeCentralSlashEventsYAML(b *strings.Builder, mergedEvents map[string]map
 			continue
 		}
 		types := sliceutil.SortedKeys(typeSet)
-		b.WriteString("  " + eventName + ":\n")
+		yamlEventName := eventName
+		if eventName == "pull_request" {
+			yamlEventName = "pull_request_target"
+		}
+		b.WriteString("  " + yamlEventName + ":\n")
 		b.WriteString("    types: [" + strings.Join(types, ", ") + "]\n")
 	}
 }

pkg/workflow/central_slash_command_workflow_test.go

@@ -105,7 +105,8 @@ func TestGenerateCentralSlashCommandWorkflow_GeneratesWorkflow(t *testing.T) {
 	require.Contains(t, text, "          destination: ${{ runner.temp }}/gh-aw/actions")
 	require.Contains(t, text, "issues:")
 	require.Contains(t, text, "issue_comment:")
-	require.Contains(t, text, "pull_request:")
+	require.Contains(t, text, "pull_request_target:")
+	require.NotContains(t, text, "\n  pull_request:\n")
 	require.Contains(t, text, "discussion_comment:")
 	require.Contains(t, text, `"triage":[{"workflow":"triage-issue","events":["issue_comment","issues"],"ai_reaction":"eyes","status_comment":true},{"workflow":"triage-pr","events":["pull_request","pull_request_comment"],"ai_reaction":"rocket","status_comment":true}]`)
 	require.Contains(t, text, `"cloclo":[{"workflow":"cloclo","events":["discussion_comment"],"ai_reaction":"heart","status_comment":true}]`)
@@ -202,7 +203,8 @@ func TestGenerateCentralSlashCommandWorkflow_GeneratesForDecentralizedLabelsOnly
 	text := string(content)
 	require.Contains(t, text, "GH_AW_LABEL_ROUTING")
 	require.Contains(t, text, `"ci-doctor":[{"workflow":"ci-doctor","events":["pull_request"]}]`)
-	require.Contains(t, text, "pull_request:")
+	require.Contains(t, text, "pull_request_target:")
+	require.NotContains(t, text, "\n  pull_request:\n")
 	require.Contains(t, text, "types: [labeled]")
 	require.Contains(t, text, "#   slash commands:")
 	require.Contains(t, text, "#     (none)")