docs(README): note pull_request_target for fork-based flow

[mikehardy]

Thinking about integrating this but did a deep-dive on the issues first, seems like one of the biggies is solved now but not noted yet since it's new info, here's a maybe-useful edit?

[mikehardy]

And looks like it needs to be changed in your workflow :-)

1s
##[error]Resource not accessible by integration
Run amannn/action-semantic-pull-request@master
[@octokit/rest] `const Octokit = require("@octokit/rest")` is deprecated. Use `const { Octokit } = require("@octokit/rest")` instead
[@octokit/rest] `const Octokit = require("@octokit/rest")` is deprecated. Use `const { Octokit } = require("@octokit/rest")` instead
##[error]Resource not accessible by integration

[amannn]

@mikehardy Would you like to rebase this on the latest master so we can try if the token works correctly?

[mikehardy]

Sure - I used the web UI for the patch workflow, let me clone local rebase and push

[mikehardy]

boom! 👍
Love it when things work

[amannn]

Really cool! 🎉

[amannn]

Would it make sense that we just use pull_request_target in the snippet below or is there any drawback to this?

If so, I guess we could move this section to the bottom of the README and re-word it to something like:

Note that the usage of pull_request_target as the event trigger is necessary for a fork-based workflow so the API token is valid for status reporting.

What do you think?

[mikehardy]

🤔 good question. I think pull_request_target is probably the best. We're not comparing code so it's okay the code used for the check is from the branch point (which is how pull_request_target protects secrets etc). It's just the title.

I can't think of any drawback to having pull_request_target be the default, but without it this fails on fork-based workflows.

So I think pull_request_target is likely the best default yes

[mikehardy]

Okay @amannn I agree with both your suggestions and just implemented them. I was using the Web UI to do it quickly so now there are 3 commits where one would do but I assume you can squash :-).

[amannn]

Perfect, thanks a lot for your help!