pull_request_target should not check out PRs
pull_request_target runs in the base repo and can read that repo's secrets. Checking out the pull request head runs the pull request's code in that job.
The trigger and the checkout are one finding
A workflow with `on: pull_request_target` runs in the base repository. It can read that repository's secrets. The workflow that matters is the one on the base branch, which is why a fork can hit it before anyone merges the fork's workflow change.
The checkout this check is written for is `ref: ${{ github.event.pull_request.head.sha }}`, or the same idea with `head.ref`. The pull-request-target check looks for `pull_request_target` together with a checkout of the head ref or head sha. It reads the workflow YAML. It does not open the pull request. A `pull_request` workflow is not this finding. A `pull_request_target` job that checks out only the base repository is not this finding either. Both halves have to be in the file you paste.
Read the diff without running it
If the job only needs the diff, fetch the diff and print the paths. Don't `actions/checkout` the head, and don't `run` a script from the pull request. If the job has to build the pull request, use `pull_request`. A `pull_request` from a fork does not receive the base repository's secrets. A `pull_request` from a branch in the same repository can.
Paste the workflow. Quote the `on:` block and the checkout `ref`. `permissions: contents: write` is a different line. This check does not read it. `uses: actions/checkout@main` is the action-pin check.