pull_request_target, and the workflow that should not have used it

The trigger exists so a workflow on a fork pull request can access secrets, which is precisely why checking out the fork’s code under it is dangerous.

# the dangerous shape
on: pull_request_target
jobs:
  test:
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}   # fork code
      - run: npm ci && npm test    # fork's package.json scripts,
                                   # with repository secrets in env

A fork can put anything in a build script, and pull_request_target runs with the base repository’s token and secrets. Ours was added to let a labelling step comment on external pull requests and had grown a test job underneath it. The split is the fix: pull_request for anything that runs contributor code, pull_request_target for a job that touches no checkout at all.