From e4694f2e9cf9a887849a07c170c3c2478feb644e Mon Sep 17 00:00:00 2001
From: thc1006 <84045975+thc1006@users.noreply.github.com>
Date: Sat, 8 Aug 2026 22:22:23 +0800
Subject: [PATCH] CI: run the changelog job for pull requests from forks

`Populate Changelog` fails for every pull request opened from a fork, and only
those. GitHub withholds secrets from a `pull_request` run whose head is a fork,
so `secrets.RELEASE_TOKEN` is empty and the checkout stops after a few seconds:

    ##[error]Input required and not supplied: token

The effect is that no outside contribution gets a changelog entry. #1102, #1103
and #1108 all landed without one and had to be added by hand.

`pull_request_target` receives secrets because it runs in the context of the
base repository. That is also why it needs care, and why this belongs on master
rather than develop: the workflow definition is read from the default branch,
so a copy that only exists on develop would never be loaded.

Nothing from the pull request is executed here. The checkout is `ref: develop`,
the updater is inline in the workflow rather than a script from the tree, and
the title and labels reach Python through the environment instead of the shell.

`permissions` drops to `contents: read`. The job's writes go through
RELEASE_TOKEN, which the checkout persists, so GITHUB_TOKEN does not need write
and should not have it now that the trigger runs with secrets available.

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
---
 .github/workflows/changelog.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 6ad2ec49b..c04f35d81 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -1,12 +1,21 @@
 name: Populate Changelog
 on:
-  pull_request:
+  # `pull_request_target`, not `pull_request`. Secrets are withheld from a
+  # `pull_request` run whose head is a fork, so RELEASE_TOKEN arrived empty and
+  # the checkout below failed for every outside contribution.
+  #
+  # Nothing from the pull request is executed. The checkout is `ref: develop`,
+  # and the updater is inline below, which under this trigger is read from the
+  # default branch rather than from the merged head.
+  pull_request_target:
     types: [closed]
     branches:
       - develop
 
+# Read, because the job's own writes go through RELEASE_TOKEN. This trigger runs
+# with secrets available, so GITHUB_TOKEN should not also carry write.
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   Changelog: