Skip to content

ci: use pull_request_target so auto-assign works on fork PRs - #161

Merged
modem7 merged 1 commit into
masterfrom
ci/auto-assign-fork-prs
Sep 19, 2026
Merged

modem7 merged 1 commit into
masterfrom
ci/auto-assign-fork-prs

Conversation

@modem7

@modem7 modem7 commented Sep 19, 2026

Copy link
Copy Markdown
Owner

What

Switch the auto-assign-pr job from the pull_request trigger to pull_request_target.

Why

PRs opened from forks get a read-only GITHUB_TOKEN under pull_request, regardless of the job's permissions: block. The assign call is rejected, so the job fails on every fork PR, for example #160:

Resource not accessible by integration (403)
https://docs.github.com/rest/issues/assignees#add-assignees-to-an-issue

pull_request_target runs in the context of the base repo with a write-capable token, so assignment works for fork PRs too.

Safety

The usual pull_request_target risk is checking out and running untrusted PR code with a privileged token. This job never does that. It has no checkout step and only calls pozil/auto-assign-issue to assign modem7. Nothing from the PR is executed.

Notes

  • The job's if: condition is updated to match the new event name.
  • The github.actor != 'renovate[bot]' guard is unchanged.
  • Same-repo PRs (for example Renovate) are unaffected.

@modem7
modem7 merged commit 825bebb into master Sep 19, 2026
1 check passed
@modem7
modem7 deleted the ci/auto-assign-fork-prs branch September 19, 2026 21:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant