Question

Your team maintains a public repository that receives many pull requests from forks. You need a workflow that automatically labels incoming PRs based on which files changed, and the labeling step requires write access to the repository's issues/PRs. A security review flags that using the standard 'pull_request' event does not grant sufficient token permissions for PRs originating from forks. Which trigger and configuration correctly allows the labeling job to run with write access while handling fork PRs?

Accepted Answer

Use the 'pull_request_target' event, which runs in the context of the base repository and provides a token with write permissions; scope permissions with 'permissions: pull-requests: write' and avoid checking out untrusted PR code.

Answer

Use the 'pull_request' event and add 'permissions: write-all' at the workflow level to force the fork PR token to gain write access.

Answer

Use the 'workflow_dispatch' event so a maintainer manually triggers labeling, since fork PRs can never receive a write-scoped token under any event.

Answer

Use the 'pull_request' event with 'secrets: inherit' so the fork PR inherits the base repository's write-scoped GITHUB_TOKEN.