fix(workflows): close pull_request_target fork-checkout hole; bump actions to latest

[eleshar]

Summary

Targets #2351 (release/v1.0.0).

• metadata-governance.yml checked out the PR submitter's fork branch (github.event.pull_request.head.ref) under pull_request_target while holding a token scoped issues:write/pull-requests:write/repository-projects:write, then executed scripts from that checkout. A PR could edit those scripts to run with that token — the classic "pwn request" pattern. Per GitHub's securely-using-pull_request_target guidance, removed the repository:/ref: override so the checkout always resolves to the trusted base branch, matching the safe pattern already used correctly in openspec-progress-phase.yml elsewhere in this same release.
• Verified every pinned action version across all 55 workflow files against each action's actual latest release (via the GitHub API, not assumption) and bumped anything behind: checkout v4→v7, setup-node v3/v4→v7, upload-artifact v3/v4→v7, download-artifact v4→v8, github-script v7→v9, create-github-app-token v2→v3, labeler v5→v7, tj-actions/changed-files v46→v47, add-to-project v1.0.2→v2.0.0. Checked each project's release notes first — all are Node-runtime/feature bumps, no breaking API changes for how these workflows use them.
• Left alone: actions already on latest (checkout/create-github-app-token pinned by SHA with version comments — already resolve to current), deploy-pages/upload-pages-artifact/codecov-action/slack-github-action/lychee-action/mergify-ci (already latest major), titoportas/update-project-fields@v0.1.0 (unmaintained since 2022, nothing newer exists).

Test plan

• CI on this branch passes
• Confirm metadata-governance.yml's issue-type-sync path (native type sync via LS_APP_PRIVATE_KEY) still fires correctly on issues events — untouched by this change but worth re-verifying end to end

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (5)

• main
• develop
• feature/*
• fix/*
• update/*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 573dea73-9bbf-4659-979c-94f3abb8f024

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized keys: "auto_labels", "auto_assign", "auto_review"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚫 This PR description is missing required template content.

Missing required section(s): Linked issues, Changelog, Global DoD checklist

Please update the PR body using one of the repository PR templates:

• https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md
• https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE

Empty placeholders, unchecked checklist boxes, and stub issue references do not count.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-27 10:56 UTC · Rule: dependabot-develop · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-27 10:56 UTC · at 752eb19057635c68c0fa2fba5fa8be85a4d0369e · squash

This pull request spent 9 seconds in the queue, including 1 second running CI.

Required conditions to merge

[github-actions]

Milestone Allocation

node:internal/modules/package_json_reader:314
throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
^
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'octokit' imported from /home/runner/work/.github/.github/scripts/automation/allocate-to-milestone.js
at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
at packageResolve (node:internal/modules/esm/resolve:768:81)
at moduleResolve (node:internal/modules/esm/resolve:855:18)
at defaultResolve (node:internal/modules/esm/resolve:985:11)
at #cachedDefaultResolve (node:internal/modules/esm/loader:747:20)
at ModuleLoader.resolve (node:internal/modules/esm/loader:724:38)
at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:320:38)
at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
code: 'ERR_MODULE_NOT_FOUND'
}
Node.js v22.23.2