From 90e0d89f48661d19862688b17f82d3c6249de74c Mon Sep 17 00:00:00 2001
From: addshore <git@addshore.com>
Date: Sat, 26 Sep 2026 09:44:06 +0100
Subject: [PATCH] fix(ci): notify Mattermost for forked pull requests

This came up the last time I raised a PR in this repo, and looks like
it's still an issue.
We discussed approach last time (I think in the office) an there was no
conclusion to what should be done:
 - Either the current thing so the hook fires? (if that is desired)
 - Don't fire the job on events from forked PRs?
 - Something else

Anyway, no matter what the team decides, having CI fail for a known
reason doesnt seem ideal, so hopfully this will just get merged, even
if another option from the above list is then chosen.
---
 .github/workflows/mattermost.yml | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mattermost.yml b/.github/workflows/mattermost.yml
index 992f0fd31..2b8aba4d0 100644
--- a/.github/workflows/mattermost.yml
+++ b/.github/workflows/mattermost.yml
@@ -1,14 +1,24 @@
+# SECURITY: pull_request_target runs this workflow from the base branch, not the
+# pull request's branch. This lets it access repository secrets for forked PRs.
+# Do not check out, run, or otherwise consume pull-request code in this workflow.
+# https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened, reopened ]
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     if: ${{ github.actor != 'dependabot[bot]' }}
+    env:
+      MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
     steps:
-      - uses: mattermost/action-mattermost-notify@v2.1.0
+      - name: Notify Mattermost
+        if: ${{ env.MATTERMOST_WEBHOOK_URL != '' }}
+        uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0
         with:
-          MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
+          MATTERMOST_WEBHOOK_URL: ${{ env.MATTERMOST_WEBHOOK_URL }}
           TEXT: "Pull request opened: [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }})"