Refactor some GH workflows

Signed-off-by: Carlos Rodríguez Hernández <carlos.rodriguez-hernandez@broadcom.com>

ai-assisted=no

.github/workflows/assign-asset-label.yml

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: APACHE-2.0
 
 name: '[Support] Assign asset label'
+# pull_request_target: fork PRs need a write-capable token to add labels; this workflow
+# does not checkout the PR branch (only downloads unified diff via diff_url).
 on:
   pull_request_target:
     types:

.github/workflows/ci-update.yml

@@ -2,8 +2,9 @@
 # SPDX-License-Identifier: APACHE-2.0
 
 name: '[CI/CD] CI Update'
+# pull_request: fork PRs do not receive base-repo secrets; BOT_TOKEN push only runs for same-repo PRs.
 on: # rebuild any PRs and main branch changes
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
@@ -11,7 +12,7 @@ on: # rebuild any PRs and main branch changes
       - labeled
     branches:
       - main
-      - bitnami:main
+      - "bitnami:main"
 # Remove all permissions by default
 permissions: {}
 # Avoid concurrency over the same PR
@@ -41,6 +42,7 @@ jobs:
       contents: read
     if: |
       needs.get-chart.outputs.result == 'ok' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
       (
         contains(github.event.pull_request.labels.*.name, 'verify') || (github.event.action == 'labeled' && github.event.label.name == 'verify')
       )

.github/workflows/ci-verify.yml

@@ -11,7 +11,7 @@ on: # rebuild any PRs and main branch changes
       - labeled
     branches:
       - main
-      - bitnami:main
+      - "bitnami:main"
 # Remove all permissions by default
 permissions: {}
 # Avoid concurrency over the same PR
@@ -112,11 +112,9 @@ jobs:
       contents: read
     if: needs.get-chart.outputs.result == 'ok'
     steps:
-      - name: Checkout bitnami/charts
+      - name: Checkout bitnami/charts (PR merge ref)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           path: charts-pr
       - name: Checkout bitnami/charts
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

.github/workflows/license-headers.yml

@@ -2,14 +2,15 @@
 # SPDX-License-Identifier: APACHE-2.0
 
 name: '[License] Check license headers'
+# pull_request + default checkout uses the merge ref; avoids pull_request_target + PR head checkout.
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - synchronize
     branches:
       - main
-      - bitnami:main
+      - "bitnami:main"
 # Remove all permissions by default
 permissions: {}
 jobs:
@@ -21,9 +22,6 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         name: Checkout Repository
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
       - id: get-modified-files
         name: 'Get modified files'
         env:

.github/workflows/move-closed-issues.yml

@@ -7,6 +7,7 @@ on:
   issues:
     types:
       - closed
+  # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here.
   pull_request_target:
     types:
       - closed

.github/workflows/pr-reviews-requested.yml

@@ -4,6 +4,7 @@
 # NOTE: This workflow is maintained in the https://github.com/bitnami/support repository
 name: '[Support] Review based card movements'
 on:
+  # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here.
   pull_request_target:
     types:
       - review_requested

.github/workflows/reasign.yml

@@ -4,6 +4,7 @@
 # NOTE: This workflow is maintained in the https://github.com/bitnami/support repository
 name: '[Support] Review based card movements'
 on:
+  # pull_request_target: required so secrets: inherit reaches bitnami/support; no PR checkout here.
   pull_request_target:
     types:
       - labeled

.github/workflows/triage.yml

@@ -9,6 +9,8 @@ on:
     types:
       - reopened
       - opened
+  # pull_request_target: required so secrets: inherit reaches bitnami/support for Projects;
+  # this caller does not checkout the PR branch (audit child workflow for unsafe checkouts).
   pull_request_target:
     types:
       - reopened