justinmclean opened a new issue, #4449: URL: https://github.com/apache/iggy/issues/4449
### Bug description - What you were doing: checking apache/iggy against the ASF GitHub Actions policy (https://infra.apache.org/github-actions-policy.html), which says pull_request_target MUST NOT be used on any workflow that holds a token, and that the trigger is disabled for ASF repositories from November 2026. - What you expected: no workflow to use pull_request_target with a token. - What actually happened: pr-triage-apply.yml (S-* lifecycle labels and the welcome comment) and stale-prs-unmark.yml (clears S-stale on push, reopen and ready) both use it with a write token. Both will stop working in November. The comment and review paths already use the pattern the policy recommends: pr-triage-collect.yml uploads the event with a read-only token and the labels are applied on workflow_run. The proposed fix routes the PR lifecycle events through the same collector and removes stale-prs-unmark.yml. One behaviour change: on a fork PR whose workflows need approval, the welcome comment and first label would wait until a maintainer approves the run, as CI already does. ### Affected area / component CI / build / tooling ### Deployment Not applicable ### Versions master at af706e68e ### Hardware / environment GitHub Actions ### Contribution - [x] I'm willing to submit a pull request to fix this bug ### Good first issue - [ ] I think this could be a good first issue for a new contributor -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
