chore: code review changes

Author: ovflowd

.github/CODEOWNERS

@@ -8,7 +8,7 @@ codecov.yml @nodejs/web-infra
 
 # Dependencies
 pnpm-workspace.yaml @nodejs/nodejs-website @nodejs/web-infra
-pnpm-lock.yaml @nodejs/nodejs-website @nodejs/web-infra
+pnpm-lock.yaml @nodejs/web-infra
 
 # Framework
 apps/site/next.config.mjs @nodejs/web-infra
@@ -30,9 +30,8 @@ apps/site/open-next.config.ts @nodejs/web-infra
 apps/site/redirects.json @nodejs/web-infra
 
 # Critical Documents
-LICENSE @nodejs/tsc @ovflowd @bmuenzenmeyer
-GOVERNANCE.md @nodejs/tsc @ovflowd @bmuenzenmeyer
-CONTRIBUTING.md @nodejs/tsc @ovflowd @bmuenzenmeyer
+LICENSE @nodejs/tsc
+GOVERNANCE.md @nodejs/tsc
 CONTRIBUTING.md @nodejs/nodejs-website @nodejs/web-infra
 docs @nodejs/nodejs-website @nodejs/web-infra
 

.github/workflows/build.yml

@@ -10,7 +10,7 @@ on:
   push:
     branches:
       - main
-  pull_request:
+  pull_request_target:
     branches:
       - main
     types:
@@ -33,10 +33,10 @@ env:
 
 jobs:
   build:
-    # This Job should run either on non-`pull_request` events,
-    # or `pull_request` event with a `labeled` action with a label named `github_actions:pull-request`
+    # This Job should run either on non-`pull_request_target` events,
+    # or `pull_request_target` event with a `labeled` action with a label named `github_actions:pull-request`
     # since we want to run Website Builds on all these occasions. As this allows us to be certain the that builds are passing
-    if: github.event_name != 'pull_request' || github.event.label.name == 'github_actions:pull-request'
+    if: github.event_name != 'pull_request_target' || github.event.label.name == 'github_actions:pull-request'
 
     name: Build on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -62,7 +62,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # Provides the Pull Request commit SHA or the GitHub merge group ref
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
           # We only need to fetch the last commit from the head_ref
           # since we're not using the `--filter` operation from turborepo
           # We don't use the `--filter` as we always want to force builds regardless of having changes or not
@@ -122,7 +122,7 @@ jobs:
         # in order to reduce source wastages and build times.
         # Note that we skip full static builds on Crowdin-based Pull Requests as these PRs should only contain translation changes
         if: |
-          (github.event_name == 'pull_request' &&
+          (github.event_name == 'pull_request_target' &&
             github.event.pull_request.head.ref != 'chore/crowdin')
         run: node_modules/.bin/turbo deploy ${{ env.TURBO_ARGS }}
         env:
@@ -132,12 +132,12 @@ jobs:
           NODE_OPTIONS: '--max_old_space_size=4096'
           # Used for API requests that require GitHub API scopes
           NEXT_GITHUB_API_KEY: ${{ secrets.GITHUB_TOKEN }}
-          # We want to ensure that static exports for all locales do not occur on `pull_request` events
+          # We want to ensure that static exports for all locales do not occur on `pull_request_target` events
           NEXT_PUBLIC_STATIC_EXPORT_LOCALE: false
 
       - name: Sync Orama Cloud
         # We only want to sync the Orama Cloud production indexes on `push` events.
-        # We also want to sync the Orama Cloud preview (deployment) indexes on `pull_request` events (or manual triggers).
+        # We also want to sync the Orama Cloud preview (deployment) indexes on `pull_request_target` events (or manual triggers).
         # We also want to ensure that the sync only happens on the `ubuntu-latest` runner to avoid duplicate syncs
         # or Windows-based path issues.
         env:

.github/workflows/chromatic.yml

@@ -14,7 +14,7 @@ on:
     paths:
       - packages/ui-components/**
       - .github/workflows/chromatic.yml
-  pull_request:
+  pull_request_target:
     branches:
       - main
     paths:
@@ -38,7 +38,7 @@ jobs:
     # We only need to run Storybook Builds and Storybook Visual Regression Tests within Pull Requests that actually
     # introduce changes to the Storybook. Hence, we skip running these on Crowdin PRs and Dependabot PRs
     if: |
-      github.event_name != 'pull_request' ||
+      github.event_name != 'pull_request_target' ||
       (
         github.event.label.name == 'github_actions:pull-request' &&
         github.actor != 'dependabot[bot]' &&
@@ -62,7 +62,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # Provides the Pull Request commit SHA or the GitHub merge group ref
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
           # The Chromatic (@chromaui/action) Action requires a full history of the current branch in order to be able to compare
           # previous changes and previous commits and determine which Storybooks should be tested against and what should be built
           fetch-depth: 0