From 4024ef7ec83ccc4b8ad1e95a74069e6144afa838 Mon Sep 17 00:00:00 2001 From: Goran Dodig Date: Tue, 3 Nov 2026 23:06:11 +0100 Subject: [PATCH] ci: post merge notices on pull_request, not pull_request_target GitHub blocks pull_request_target in public repos by default from 2 Dec 2026. Fork PRs get no secrets under pull_request, so their merges are skipped instead of failing. --- .github/workflows/notify-slack-on-main-merge.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/notify-slack-on-main-merge.yml b/.github/workflows/notify-slack-on-main-merge.yml index 8fd459e..063a403 100644 --- a/.github/workflows/notify-slack-on-main-merge.yml +++ b/.github/workflows/notify-slack-on-main-merge.yml @@ -1,11 +1,11 @@ name: Notify Slack on Merge to Main # Posts to Slack when a PR lands on main. Opening a PR notifies nobody. -# pull_request_target runs this file from main with secrets, so merged PRs from -# forks post too. Nothing from the PR is checked out or run; the title only -# reaches the shell through an env var. +# pull_request, not pull_request_target: GitHub blocks the latter in public +# repos by default from December 2026. Fork PRs get no secrets here, so their +# merges post nothing. The title only reaches the shell through an env var. on: - pull_request_target: + pull_request: types: [closed] branches: [main] @@ -15,7 +15,10 @@ jobs: notify: name: Notify Slack runs-on: ubuntu-latest - if: ${{ github.event.pull_request.merged && vars.SLACK_CHANNEL_ID != '' }} + if: >- + github.event.pull_request.merged && + github.event.pull_request.head.repo.full_name == github.repository && + vars.SLACK_CHANNEL_ID != '' steps: # Slack reads <, > and & as markup: escape them so a PR title cannot