fix: revert to pull_request event, remove pull_request_target comment

Author: mvvmm

.github/actions/check-codeowner/index.js

@@ -10,7 +10,7 @@ function getActor(): string {
 	const { eventName, payload } = github.context;
 
 	switch (eventName) {
-		case "pull_request_target":
+		case "pull_request":
 			return payload.pull_request?.user?.login ?? "";
 		case "issue_comment":
 		case "pull_request_review_comment":

.github/actions/check-codeowner/index.ts

@@ -7,7 +7,7 @@ on:
     types: [created]
   pull_request_review:
     types: [submitted]
-  pull_request_target:
+  pull_request:
     types: [opened]
 
 concurrency:
@@ -91,14 +91,9 @@ jobs:
 
   bonk-auto-triage:
     needs: check-codeowner
-    # pull_request_target is used so the workflow always runs from the production
-    # branch, preventing PR authors from modifying bonk's behaviour. Secrets are
-    # available even for fork PRs, but the fork guard below ensures this never
-    # runs on forks. The checkout pins to the base ref — we do NOT check out or
-    # execute the PR's code. Bonk reads PR context via the GitHub API only.
     if: |
       needs.check-codeowner.outputs.is-codeowner == 'true' &&
-      github.event_name == 'pull_request_target' &&
+      github.event_name == 'pull_request' &&
       github.event.sender.type != 'Bot' &&
       github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
@@ -112,7 +107,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          ref: ${{ github.event.pull_request.base.ref }}
           fetch-depth: 1
 
       - name: Set up pnpm