A Pull Request That Runs with Your Secrets

A repository workflow uses the pull_request_target trigger, checks out the pull request's head commit, and runs its build script with a token that has write access and access to repository secrets. External contributors can open pull requests.