Fix workflow trigger for Python package version check #432
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
`pull_request_target` runs against the base and doesn't work with paths, so it's wrong. It is more targeted toward protecting workflows from rogue PRs from forks. This isn't an issue for this workflow because it doesn't use any secrets, apart from ephemeral ones generated through OIDC flows, and in any event it's protected from fork runs by the `if` check in `check-python-package-versions.yaml` on line 11.
vcschapp
requested review from
jenningsanderson,
jwass,
mojodna and
sasastanojkov
mojodna
approved these changes
Jan 30, 2026
RoelBollens-TomTom
approved these changes
Jan 30, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This change switches the trigger for the Python package version check GitHub Actions workflow from
pull_request_targettopull_request. This should result in thepathsfilter on the workflow working correctly.Because
pull_request_targetruns against the base and doesn't work with paths, it's doesn't work for the intended use case. It is more targeted toward protecting workflows from rogue PRs from forks. Such protection isn't needed for this workflow because it doesn't use any secrets, apart from ephemeral ones generated through OIDC flows, and in any event it's protected from fork runs by theifcheck incheck-python-package-versions.yamlon line 11.Testing
Ongoing, via PR #430.