#pull-request-target

GitHub Actions pull_request_target ran fork code with our secrets: closing the gap

An internal audit found a workflow that used pull_request_target to post preview links and also checked out the pull request's code and ran npm install. Any fork PR could have run code with our deploy token. We split it into an unprivileged build and a privileged comment step.