[TEST - do not merge] Prove pull_request_target ignores PR workflow edits

[andrewmumblebee]

Throwaway test PR, not meant to merge into anything.

Base is work/ah/fork-pr-runs (which already carries the pull_request_target change from #100), head is a branch that adds an injected step to pr-run.yaml which would print ::error::INJECTED STEP RAN and the length of SQUAREDUP_API_KEY if it executed.

If #100's claim holds, that step should never appear in this PR's Actions run — only the steps as committed on work/ah/fork-pr-runs should execute. Will close this once verified.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 63b52d5b-c711-4acf-b222-f6eef8e40665

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[andrewmumblebee]

Closing — this test doesn't work as designed. GitHub changed pull_request_target (effective 2025-12-08) to always resolve the workflow file from the repo's actual default branch, not the PR's base ref, so this never had a chance to fire against work/ah/fork-pr-runs. See https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes/. That's actually a stronger guarantee than what #100 relies on, but it means the new triggers can't be exercised live until they're on main.