Updated CI so Copilot-created PRs can start without waiting for manual workflow approval

[StefH]

No description provided.

[Copilot]

Pull request overview

Updates the GitHub Actions CI workflow to allow Copilot-authored pull requests to run without waiting for manual workflow approval by introducing pull_request_target and gating execution.

Changes:

• Add pull_request_target trigger alongside expanded pull_request event types.
• Restrict workflow token permissions (contents: read) and adjust job execution conditions for pull_request_target.
• Update actions/checkout to pin to the PR head SHA and disable persisted credentials; skip SonarCloud secret checks/analysis for pull_request_target.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The job gate for pull_request_target is spoofable: startsWith(github.actor, 'copilot') would allow any user with a username like copilot-foo to run this workflow in the privileged pull_request_target context. Restrict this to an explicit allow-list of the exact bot account(s) (or a non-spoofable identifier like a known actor_id) to avoid a security bypass.

[Copilot]

This actions/checkout now always checks out github.event.pull_request.head.sha for pull_request runs, which changes CI from testing the PR merge commit to testing only the PR head commit. That can miss integration failures that would occur after merging. Consider only overriding ref for pull_request_target runs (and keep the default merge ref for pull_request).

Suggested change

	ref: ${{ github.event.pull_request.head.sha || github.sha }}
	ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}

[Copilot]

The job gate for pull_request_target is spoofable: startsWith(github.actor, 'copilot') would allow any user with a username like copilot-foo to run this workflow in the privileged pull_request_target context. Restrict this to an explicit allow-list of the exact bot account(s) (or a non-spoofable identifier like a known actor_id) to avoid a security bypass.

[Copilot]

This workflow triggers on both pull_request and pull_request_target. For Copilot-authored PRs, the jobs will run for both events (because the job if passes for pull_request and for pull_request_target), which can create duplicate CI runs and may still leave a blocked pull_request run “waiting for approval”. If the intent is to run only via pull_request_target for Copilot, add a complementary skip condition for the pull_request event (or split into separate workflows).

[Copilot]

This actions/checkout now always checks out github.event.pull_request.head.sha for pull_request runs, which changes CI from testing the PR merge commit to testing only the PR head commit. That can miss integration failures that would occur after merging. Consider only overriding ref for pull_request_target runs (and keep the default merge ref for pull_request).

Suggested change

	ref: ${{ github.event.pull_request.head.sha || github.sha }}
	ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}

[StefH]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all changes from the review thread in commit a975fc9:

1. Spoofable actor check (lines 17 & 45): Replaced startsWith(github.actor, 'copilot') with an explicit allowlist — jobs now only run on pull_request_target when the actor is exactly copilot-swe-agent[bot] or github-copilot[bot].

2. ref override (lines 28 & 55): Changed to ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }} so normal pull_request events still test the merge commit, not just the head commit.

3. Duplicate CI runs (lines 17 & 45): The if condition now skips the job for pull_request events from Copilot bot actors (they're handled via pull_request_target instead), preventing duplicate runs.