From de2e1cab721662a2b9617c35c61d38cbba882e9d Mon Sep 17 00:00:00 2001 From: johentsch Date: Wed, 7 Oct 2026 23:00:23 +0200 Subject: [PATCH] fix: use pull_request_target in version_release workflow pull_request workflows triggered by fork PRs receive no secrets, so checkout failed with "Input required and not supplied: token" (MS3_BOT_TOKEN empty). pull_request_target runs in the base repo context with secrets. Safe because the job only checks out the base branch. --- .github/workflows/version_release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/version_release.yml b/.github/workflows/version_release.yml index 1c6abd450..ebfefae1a 100644 --- a/.github/workflows/version_release.yml +++ b/.github/workflows/version_release.yml @@ -1,5 +1,7 @@ on: - pull_request: + # pull_request_target (not pull_request) so that secrets are available for PRs from forks. + # Safe because the job only checks out the base branch and never runs code from the PR head. + pull_request_target: types: - closed