Update cherry-picker to use pull_request_target (pantsbuild#19048)

Otherwise we can't see secrets and have failures.
sww · May 19, 2023 · 9d29b3d · 9d29b3d
1 parent 4c708a0
commit 9d29b3d
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/.github/workflows/auto-cherry-picker.yaml b/.github/workflows/auto-cherry-picker.yaml
@@ -1,11 +1,11 @@
 name: Auto Cherry-Picker
 
 on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - main
+  # NB: This is safe since we already have merged the PR.
+  # See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+  pull_request_target:
+    types: [closed]
+    branches: [main]
   workflow_dispatch:
     inputs:
       PR_number: