Trigger forward-port on pull_request_target

[ThaminduDilshan]

Purpose

The forward-port workflow was not triggering for merged PRs on 1.0.x. After switching the trigger to pull_request_target (#5043), merges into 1.0.x (#5040) produced zero runs.

Root cause: pull_request and pull_request_target resolve the workflow file from different refs.

Trigger	Workflow file resolved from	Secrets for fork PRs
pull_request	the PR's base branch (1.0.x)	withheld
pull_request_target	the repository default branch (main)	available

Per GitHub docs, pull_request_target "will only trigger a workflow run if the workflow file exists on the default branch" and runs in the default branch context. The pull_request_target trigger was added only to 1.0.x (#5043), so it was never registered. It must live on main.

Contributor PRs are merged from forks, and pull_request withholds secrets for fork PRs, so secrets.THUNDER_AUTOMATION_BOT resolved to empty and actions/checkout failed with Input required and not supplied: token. pull_request_target runs with secrets and a write-scoped token even for fork PRs.

Approach

Change main's copy of the workflow trigger from pull_request to pull_request_target. The branches: ["1.0.x"] filter still applies to the PR's base ref, so the workflow only fires for merges into 1.0.x, runs in main's context, and has access to secrets.

Security: the job checks out the trusted target branch (main) and cherry-picks the original PR's commits by SHA. It never checks out or executes fork head code, so pull_request_target is safe here. The forward-ported changes land in a new PR that goes through normal review and CI.

The inert copy left on 1.0.x (from #5037/#5043) is harmless: pull_request_target ignores non-default-branch definitions, so it never triggers and does not conflict with this one.

Related Issues

• N/A

Related PRs

• Add git action to frontport patch fixes #5004, Add forward-port workflow to 1.0.x branch #5037, Update PR forward port workflow #5043

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
  • Ran Vale and fixed all errors and warnings
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the automation workflow trigger for closed pull requests on the configured patch branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f2b182a9-b72c-4dc6-a44e-7a0371cbd5ee

📥 Commits

Reviewing files that changed from the base of the PR and between 394140c and b909386.

📒 Files selected for processing (1)

• .github/workflows/forward-port-pr.yml

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The forward-port workflow trigger changes from pull_request to pull_request_target for closed pull requests on the configured patch branch.

Changes

Forward-port workflow

Layer / File(s)	Summary
Update workflow trigger .github/workflows/forward-port-pr.yml	The workflow now uses pull_request_target instead of pull_request.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to b9093

This localized workflow change updates when forward-port automation runs; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• thunder-id/thunderid#5004: This PR adds the forward-port-pr.yml workflow whose trigger this change updates.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: switching the forward-port workflow trigger to pull_request_target.
Description check	✅ Passed	The description explains the purpose, root cause, approach, security considerations, related PRs, and checklist status with sufficient detail.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!