re: `pull_request_target` and fork PRs - You can get around the !Even More Fun! limitations this has (GITHUB_TOKEN being read-only) by having a workflow called by another workflow.
For example, I wrote a set of workflows[1] to automatically apply a label after 2 'review approvals'.
First, a 'dummy' workflow triggering off PRs (in that context) that uploads an artifact: the PR number
Second, the 'real' workflow that runs in the context of the actual repository, set to be `on: workflow_run: workflows: - Final Review Labeler` - this pulls in the artifact, runs a GraphQL query, and applies the label if applicable.
For example, I wrote a set of workflows[1] to automatically apply a label after 2 'review approvals'.
First, a 'dummy' workflow triggering off PRs (in that context) that uploads an artifact: the PR number
Second, the 'real' workflow that runs in the context of the actual repository, set to be `on: workflow_run: workflows: - Final Review Labeler` - this pulls in the artifact, runs a GraphQL query, and applies the label if applicable.
[1]: https://github.com/goonstation/goonstation/blob/master/.gith...