From 8a65b0adde0f62e03865548dd18a7e86c870c485 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:39:59 +0200
Subject: [PATCH 1/3] fix(conventional-commit): avoid dangerous trigger in
 example

---
 conventional-commits/README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/conventional-commits/README.md b/conventional-commits/README.md
index 62b861f..bd07ad1 100644
--- a/conventional-commits/README.md
+++ b/conventional-commits/README.md
@@ -55,11 +55,12 @@ The workflow requires `pull-requests: read` permission to access PR information
 name: Lint PR Title
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - reopened
+      - synchronize
 
 jobs:
   lint-pr-title:

From 6e0b827de0a6ab982bd0144eea0af24dde924945 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:26:34 +0200
Subject: [PATCH 2/3] docs: add hint on pull_request vs pull_request_target

---
 conventional-commits/README.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/conventional-commits/README.md b/conventional-commits/README.md
index bd07ad1..ff983b6 100644
--- a/conventional-commits/README.md
+++ b/conventional-commits/README.md
@@ -69,9 +69,17 @@ jobs:
     uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@conventional-commits-v1.0.1
 ```
 
+### ⚠️ Use `pull_request`, not `pull_request_target`
+
+Trigger this workflow with `pull_request`. It only reads the PR title, so it needs neither repository secrets nor a write-capable token, and the read-only `GITHUB_TOKEN` that `pull_request` grants to fork PRs is enough.
+
+Avoid `pull_request_target`: it runs with the base repository's secrets and a privileged token, which exposes the repository to "pwn request" attacks from forks. GitHub also applies a [default policy that blocks `pull_request_target` in public repositories](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target#default-policy-for-pull_request_target), so workflows still relying on it will stop running once the policy is enforced.
+
+Include the `synchronize` type so the check re-runs on every push to the PR. Otherwise, required status checks can be left pending on the new head commit.
+
 ## 📋 Implementation Notes
 
-- 🔄 The workflow runs automatically when PRs are opened, edited, or reopened to ensure continuous validation
+- 🔄 The workflow runs automatically when PRs are opened, edited, reopened, or synchronized to ensure continuous validation
 - ✅ It validates the PR title against the Conventional Commits specification with comprehensive checks
 - 💬 If validation fails, the workflow writes detailed guidance on how to fix the title to the job summary
 - 🔗 This workflow is particularly useful when combined with the release-please workflow for a fully automated release process

From b40f8edc07bd89049493048e4e1fd85d583f2049 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Tue, 13 Oct 2026 10:27:51 +0200
Subject: [PATCH 3/3] docs: fix stale use ref

---
 conventional-commits/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conventional-commits/README.md b/conventional-commits/README.md
index ff983b6..b6f0a54 100644
--- a/conventional-commits/README.md
+++ b/conventional-commits/README.md
@@ -66,7 +66,7 @@ jobs:
   lint-pr-title:
     permissions:
       pull-requests: read
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@conventional-commits-v1.0.1
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@main # ⚠️ use tagged version here
 ```
 
 ### ⚠️ Use `pull_request`, not `pull_request_target`