From 04be0bf7969aea38d935b3b3726f71add89d2664 Mon Sep 17 00:00:00 2001
From: Gauvain <contact@uruk.dev>
Date: Tue, 7 Jul 2026 00:11:29 +0200
Subject: [PATCH] ci(pr-title): use pull_request_target and guard the cleanup
 with success()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pull_request_target gives fork PRs a write token so the title-lint sticky
comment posts for external contributors (the workflow only reads the title and
comments — it never checks out or runs PR code). Also AND the delete-comment
step with success() so a crashed lint run (not a lint violation) can't leave
error_message unset and wrongly delete the error comment.
---
 .github/workflows/pr-title.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 80b561d2..44766516 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -1,15 +1,21 @@
 name: 📝 PR Title
 
+# pull_request_target so fork PRs get a write token — this workflow only reads
+# the PR title and posts/updates a sticky comment; it never checks out or runs
+# PR code, so it is not exposed to the usual _target code-execution risk.
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, edited, synchronize, reopened]
     branches: [develop, master]
 
 permissions:
   contents: read
 
+# Key on the PR number, not github.ref: under pull_request_target github.ref is
+# the base branch (shared by every PR), which would collapse all PRs into one
+# group and cross-cancel their title checks.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:
@@ -38,7 +44,7 @@ jobs:
             ${{ steps.lint_pr_title.outputs.error_message }}
             ```
 
-      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
+      - if: ${{ success() && steps.lint_pr_title.outputs.error_message == null }}
         uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         with:
           header: pr-title-lint-error