fix: use pull_request_target so vuln-gate/auto-merge work on real Dependabot PRs

[MusaMisto]

GitHub treats Dependabot-authored PRs like fork PRs for secrets purposes: a plain pull_request trigger gets no repository secrets and a read-only GITHUB_TOKEN, regardless of the permissions: block requested. Since both critical-vuln-check.yml and dependabot-auto-merge.yml exist specifically to react to Dependabot's own PRs, this silently broke them for their actual primary purpose across the whole org-wide rollout — confirmed live on AVTR-Recycling-Treatment/avtr-field-mobile, where all 17 real Dependabot PRs failed with "missing dependabot-alerts-token" while PRs authored by a human passed cleanly.

Switches both templates to pull_request_target, which evaluates the workflow file from the trusted base branch, restoring real secrets/write-token access. Verified live: reopened a real Dependabot PR on avtr-field-mobile after applying this fix there — vuln-gate / check now passes (was previously failing on that same PR).

Safe from the usual pull_request_target risk (a workflow checking out and running the PR's own code with elevated secrets) because neither workflow ever does that — critical-vuln-check.yml's job is a pure Dependabot Alerts API query, and dependabot-auto-merge.yml's auto-merge job only reads PR metadata via the API and calls gh pr merge by URL.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 797ea4eb-d363-42d9-aadc-8c8fa32a0842

📥 Commits

Reviewing files that changed from the base of the PR and between abf81fb and 7225cf7.

📒 Files selected for processing (2)

• workflow-templates/critical-vuln-check.yml
• workflow-templates/dependabot-auto-merge.yml

📜 Recent review details

🔇 Additional comments (2)

workflow-templates/critical-vuln-check.yml (1)

19-35: LGTM!

workflow-templates/dependabot-auto-merge.yml (1)

20-36: LGTM!

---

📝 Walkthrough

Summary

• Switched both Dependabot workflows to pull_request_target to restore access to the Dependabot Alerts token and write-capable GITHUB_TOKEN.
• Preserved existing vulnerability gating and patch-only, ecosystem-limited auto-merge behavior.
• No PR code is checked out or executed; the workflows use API metadata and merge the PR by URL.

Risk:risk:low

Security-sensitive areas

• pull_request_target runs with repository secrets and write permissions. The exposure is limited by Dependabot-only gating and the absence of PR-code execution.
• The workflows rely on the trusted base-branch definitions and the configured DEPENDABOT_ALERTS_TOKEN.

Test coverage impact

• No automated test changes.
• Live verification confirmed the vulnerability gate passes for a real Dependabot PR after the trigger change.

Operational concerns

• Repositories using these templates must have DEPENDABOT_ALERTS_TOKEN configured with Dependabot Alerts read access.
• No migration or deployment steps are required. Reverting the trigger changes would restore the prior Dependabot failures.

Walkthrough

Both workflow templates now trigger on pull_request_target instead of pull_request, with comments documenting Dependabot token and permissions behavior. Existing workflow names, filters, permissions, and job logic remain unchanged.

Changes

Dependabot workflow triggers

Layer / File(s)	Summary
Critical vulnerability check trigger workflow-templates/critical-vuln-check.yml	Documentation explains the Dependabot Alerts API token behavior, and the workflow trigger changes to pull_request_target.
Dependabot auto-merge trigger workflow-templates/dependabot-auto-merge.yml	Documentation is updated for the revised trust and token behavior, and the workflow trigger changes to pull_request_target.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels:infra, security, risk:high

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly summarizes the switch to pull_request_target for Dependabot vuln-check and auto-merge workflows.
Description check	✅ Passed	It accurately describes the trigger change, Dependabot secret behavior, and the security rationale.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}