Fix sync-rush-versions workflow permissions for Dependabot PRs

[Copilot]

The sync-rush-versions.yml workflow fails on Dependabot PRs due to read-only GITHUB_TOKEN permissions with the pull_request trigger, preventing it from pushing commits to sync rush.json and regenerate lockfiles.

Changes

• Trigger: Changed from pull_request to pull_request_target to grant write permissions
• Checkout references: Updated both jobs to explicitly check out PR head branch:

  - uses: actions/checkout@v6
    with:
      ref: ${{ github.event.pull_request.head.ref }}
      repository: ${{ github.event.pull_request.head.repo.full_name }}

Security

Safe use of pull_request_target as the workflow:

• Only runs when github.actor == 'dependabot[bot]'
• Executes no code from the PR, only syncs configuration files

Original prompt

Problem

The sync-rush-versions.yml GitHub Actions workflow is not running on Dependabot pull requests because workflows triggered by Dependabot have read-only GITHUB_TOKEN permissions by default. This prevents the workflow from pushing commits to sync the rush.json file and regenerate lockfiles.

Solution

Update the workflow to use pull_request_target instead of pull_request trigger. This change will:

• Grant the workflow write permissions needed to push commits
• Allow the workflow to run properly on Dependabot PRs
• Maintain security by only running on Dependabot-authored PRs

Required Changes

Update .github/workflows/sync-rush-versions.yml:

1. Change the trigger from pull_request to pull_request_target
2. Add explicit checkout references to ensure the PR branch is checked out:
   • Use ref: ${{ github.event.pull_request.head.ref }}
   • Use repository: ${{ github.event.pull_request.head.repo.full_name }}

Security Considerations

Using pull_request_target is safe in this context because:

• The workflow only runs when github.actor == 'dependabot[bot]'
• No code from the PR is executed
• Only configuration files (rush.json, lockfiles) are being synced

References

• Troubleshooting Dependabot on GitHub Actions
• Automating Dependabot with GitHub Actions

This pull request was created from Copilot chat.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR updates the sync-rush-versions.yml workflow to fix permission issues preventing it from running on Dependabot pull requests. The workflow needs write permissions to push commits that sync rush.json and regenerate lockfiles.

Key Changes:

• Changed trigger from pull_request to pull_request_target to grant write permissions
• Updated checkout steps to explicitly reference the PR head branch using github.event.pull_request.head.ref and github.event.pull_request.head.repo.full_name