> See Solr's renovate-changelog-* workflows > <https://github.com/apache/solr/tree/main/.github/workflows>which safely > write to a fork's PR branch. We recently converted it from a single > pull_request_target workflow to this two-stage approach to avoid the > security risk.
This is far from trivial though? Requires a separate github account and a pat token with permissions. I'll just turn off this workflow for now because it makes life unbearable. Dawid
