From be9f312457c68cd711806050568ad25f31f49c80 Mon Sep 17 00:00:00 2001 From: Daniel McIlvaney Date: Thu, 28 May 2026 17:53:53 -0700 Subject: [PATCH] fix(ci): only trigger the conventional commits check on 4.0 --- .github/workflows/check-pr-title.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml index 08ba683c72d..6db27e4bcf3 100644 --- a/.github/workflows/check-pr-title.yml +++ b/.github/workflows/check-pr-title.yml @@ -12,6 +12,11 @@ name: "Check PR Title" on: pull_request_target: # zizmor: ignore[dangerous-triggers] + # Only run on PRs targeting 4.0. pull_request_target always uses the workflow + # from the default branch. This PR does not require any untrusted scripts from + # the PR branch, so it is safe to use pull_request_target. + branches: + - "4.0" types: - opened - edited @@ -27,6 +32,8 @@ permissions: {} jobs: main: name: Validate PR title + # Prevent forks from running a stale/vulnerable copy of this workflow with Actions enabled + if: github.repository == 'microsoft/azurelinux' runs-on: ubuntu-latest permissions: pull-requests: write # Needed to post comments on PR