[Security] fix pull_request_target workflow injection (pwn request)

.github/workflows/behat-5.0.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat-5.0.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'composer.json'

.github/workflows/behat-5.1.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat-5.1.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'composer.json'

.github/workflows/behat.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'composer.json'

.github/workflows/behat_ui-5.0.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat_ui-5.0.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'composer.json'

.github/workflows/behat_ui-5.1.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat_ui-5.1.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'composer.json'

.github/workflows/behat_ui.yml

@@ -9,7 +9,7 @@ on:
       - '*.php'
       - 'src/**'
       - '.github/workflows/behat_ui.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'composer.json'

.github/workflows/frontend-build.yaml

@@ -2,7 +2,7 @@ name: CoreShop Studio Frontend Build
 
 # Rebuild trigger: regenerate Studio bundles via PR to satisfy branch ruleset.
 on:
-  pull_request_target:
+  pull_request:
     branches: [ '5.1', '2026.x' ]
   workflow_dispatch:
 
@@ -11,6 +11,9 @@ permissions:
 
 jobs:
   build:
+    # Only run on same-repo branches. Fork PRs get a read-only token under
+    # `pull_request`, so the auto-commit push would fail anyway.
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: write
     uses: ./.github/workflows/shared-frontend-build.yaml

.github/workflows/license-check-5.0.yaml

@@ -6,7 +6,7 @@ on:
       - 'composer.json'
       - '*/**/composer.json'
       - '.github/workflows/license-check-5.0.yaml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'composer.json'

.github/workflows/license-check-5.1.yaml

@@ -6,7 +6,7 @@ on:
       - 'composer.json'
       - '*/**/composer.json'
       - '.github/workflows/license-check-5.1.yaml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'composer.json'

.github/workflows/license-check.yaml

@@ -6,7 +6,7 @@ on:
       - 'composer.json'
       - '*/**/composer.json'
       - '.github/workflows/license-check.yaml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'composer.json'

.github/workflows/packages_bundles-5.0.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Bundle/**'
       - '.github/workflows/packages_bundles-5.0.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'src/CoreShop/Bundle/**'

.github/workflows/packages_bundles-5.1.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Bundle/**'
       - '.github/workflows/packages_bundles-5.1.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'src/CoreShop/Bundle/**'

.github/workflows/packages_bundles.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Bundle/**'
       - '.github/workflows/packages_bundles.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'src/CoreShop/Bundle/**'

.github/workflows/packages_components-5.0.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Component/**'
       - '.github/workflows/packages_components-5.0.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'src/CoreShop/Component/**'

.github/workflows/packages_components-5.1.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Component/**'
       - '.github/workflows/packages_components-5.1.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'src/CoreShop/Component/**'

.github/workflows/packages_components.yml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'src/CoreShop/Component/**'
       - '.github/workflows/packages_components.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'src/CoreShop/Component/**'

.github/workflows/static-5.0.yml

@@ -11,7 +11,7 @@ on:
       - '*.xml'
       - 'composer.json'
       - '.github/workflows/static-5.0.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.0' ]
     paths:
       - 'features/**'

.github/workflows/static-5.1.yml

@@ -11,7 +11,7 @@ on:
       - '*.xml'
       - 'composer.json'
       - '.github/workflows/static-5.1.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '5.1' ]
     paths:
       - 'features/**'

.github/workflows/static.yml

@@ -11,7 +11,7 @@ on:
       - '*.xml'
       - 'composer.json'
       - '.github/workflows/static.yml'
-  pull_request_target:
+  pull_request:
     branches: [ '2026.x' ]
     paths:
       - 'features/**'