Add runtime check to disallow pull_request_target event on public repositories

[Copilot]

pull_request_target runs in the base repo context with full secret access even when triggered from a fork, making it a "pwn request" vector on public repos. This adds a runtime enforcement check alongside the existing strict-mode and lockdown checks.

Changes

• validate_lockdown_requirements.cjs — Added check after strict-mode enforcement: reads GITHUB_EVENT_NAME + GITHUB_REPOSITORY_VISIBILITY; fails the workflow with a descriptive error if pull_request_target fires on a public repo. Sets lockdown_check_failed=true output for consistency with other guards.

• validate_lockdown_requirements.test.cjs — 7 new test cases covering: fail on public+pull_request_target, pass on public+pull_request, pass on private/internal regardless of strict mode, pass when visibility unknown, correct ordering when strict-mode check also fails.

The check only blocks public repos — private and internal repos are unaffected.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[Copilot]

Pull request overview

Adds a runtime guard to block GitHub Actions workflows from running on pull_request_target in public repositories, reducing exposure to “pwn request” style attacks.

Changes:

• Added a runtime check in validate_lockdown_requirements.cjs to fail the workflow when GITHUB_EVENT_NAME=pull_request_target and GITHUB_REPOSITORY_VISIBILITY=public, emitting lockdown_check_failed=true.
• Added Vitest coverage for pull_request_target enforcement scenarios and ordering relative to strict-mode failures.
• Updated test setup to reset GITHUB_EVENT_NAME between tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/validate_lockdown_requirements.cjs	Introduces the public-repo pull_request_target runtime enforcement and failure message/output behavior.
actions/setup/js/validate_lockdown_requirements.test.cjs	Adds test cases validating the new enforcement behavior and its interaction with strict-mode checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The error message string is escaping quotes incorrectly: \"pwn request\" in a single-quoted JS string will render with literal backslashes (e.g., \"pwn request\") in the output. Use unescaped double quotes ("pwn request" in a double-quoted string) or just "pwn request" without extra backslashes (e.g., known as a "pwn request" or known as a "pwn request" via a template literal) so the message prints cleanly.

Suggested change

	'creates a significant security risk (known as a \\"pwn request\\").\\n' +
	'creates a significant security risk (known as a "pwn request").\\n' +

[pelikhan]

@copilot Apply reviews

[Copilot]

@copilot Apply reviews

Fixed in 38ee570 — changed 'creates a significant security risk (known as a \\"pwn request\\").\\n' to 'creates a significant security risk (known as a "pwn request").\\n' so the quotes render cleanly without literal backslashes.