Repository navigation

🌱 ci: stop persisting checkout credentials in PR-tree workflows #17327

	name: Greetings
Check warning on line 1 in .github/workflows/greetings.yml View workflow run for this annotation GitHub Actions / Greetings Workflow execution policy warning (evaluate mode) On December 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

	on:
	# pull_request_target, not pull_request: on a fork PR the pull_request
	# token is read-only whatever `permissions:` says, so the welcome comment
	# 403s ("Resource not accessible by integration") on exactly the PRs it is
	# for. The greet job only calls the comment API and never checks out or
	# runs PR code, so the write-scoped target token is safe here.
	pull_request_target:
	types: [opened, reopened]
	issues:
	types: [opened, reopened]


	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	permissions:
	contents: read
	issues: write
	pull-requests: write

	jobs:
	greet:
	uses: hivecommons/infra/.github/workflows/reusable-greetings.yml@f1c0b61675386f54e63c04cf07b3aa933cc963eb # hivecommons/infra main as of 2026-09-02