From bb3c38f9f4391ae27133a75cc6e6cd8a05e0bc4a Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 15 Oct 2026 11:58:13 +0200 Subject: [PATCH 1/2] fix(zizmor): Allow issue_comment when we check the repo is not a fork Signed-off-by: Joas Schilling --- workflow-templates/command-compile.yml | 2 +- workflow-templates/command-openapi.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/workflow-templates/command-compile.yml b/workflow-templates/command-compile.yml index c9fa411f..222576cf 100644 --- a/workflow-templates/command-compile.yml +++ b/workflow-templates/command-compile.yml @@ -8,7 +8,7 @@ name: Compile Command on: - issue_comment: + issue_comment: # zizmor: ignore[dangerous-triggers] types: [created] permissions: diff --git a/workflow-templates/command-openapi.yml b/workflow-templates/command-openapi.yml index ec846832..062ea141 100644 --- a/workflow-templates/command-openapi.yml +++ b/workflow-templates/command-openapi.yml @@ -8,7 +8,7 @@ name: OpenAPI Command on: - issue_comment: + issue_comment: # zizmor: ignore[dangerous-triggers] types: [created] permissions: From 1b121238601589aee7a1f22f93f27aea8d8f910e Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 15 Oct 2026 12:03:13 +0200 Subject: [PATCH 2/2] fix(renovate): Approve without "pull_request_target" Signed-off-by: Joas Schilling --- workflow-templates/renovate-approve-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workflow-templates/renovate-approve-merge.yml b/workflow-templates/renovate-approve-merge.yml index c3187c35..178888d0 100644 --- a/workflow-templates/renovate-approve-merge.yml +++ b/workflow-templates/renovate-approve-merge.yml @@ -9,7 +9,7 @@ name: Auto approve renovate PRs on: - pull_request_target: # zizmor: ignore[dangerous-triggers] + pull_request: branches: - main - master