fix(workflows): use pull_request_target for auto-changelog-v3

[leaanthony]

Summary

Fixes auto-changelog-v3 silently failing on every external contributor PR.

Root cause

The current pull_request: closed trigger runs in the fork's context when a PR comes from a fork. GitHub strips secrets in that context, so OPENROUTER_API_KEY is empty and v3/scripts/auto-changelog.go exits with:

❌ Required env vars: PR_NUMBER, GITHUB_TOKEN, OPENROUTER_API_KEY, GITHUB_REPOSITORY

Reproduced just now on the auto-run for #5265 (AkagiYui's fork PR).

Fix

Switch to pull_request_target, which fires on the same events but runs in base-repo context with secrets attached.

Why this is safe here (despite pull_request_target's usual risks)

• The workflow already gates on github.event.pull_request.merged == true (so it only runs on real merges).
• It explicitly checks out master (never fork code).
• It only queries the GitHub API for PR metadata and runs a Go script that lives in master.

So the typical pull_request_target footgun — running fork-supplied code with elevated permissions — does not apply.

Test plan

• Manually dispatched auto-changelog-v3.yml with pr_number: 5265 (companion run) to backfill the missing entry for fix(v3/windows): fixes the 502 Bad Gateway errors that occur when using Vite as the frontend dev server in development mode #5265.
• After this PR merges, the next external-contributor PR's merge should produce an auto-changelog commit on master automatically.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal workflow configuration for pull request handling on the main branch.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

The GitHub Actions workflow trigger was changed from pull_request to pull_request_target for closed pull requests targeting the master branch, maintaining existing filter conditions and subsequent job logic.

Changes

Cohort / File(s)	Summary
Workflow Trigger Update .github/workflows/auto-changelog-v3.yml	Changed PR workflow trigger from pull_request to pull_request_target for closed PRs targeting master branch.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A trigger hops leftward, from pull to the target,
One line changed, the workflow grows smarter!
With secrets now guarded and power in place,
Our changelog v3 wins the race! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: switching the workflow trigger from pull_request to pull_request_target for the auto-changelog-v3 workflow.
Description check	✅ Passed	The PR description is mostly complete with a clear summary, root cause explanation, proposed fix, and safety justification. However, it does not follow the repository's template structure (missing Type of change checkboxes, Test Configuration section, and other template sections).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/auto-changelog-fork-perms

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 5/8 reviews remaining, refill in 15 minutes and 59 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the v3 auto-changelog GitHub Actions workflow trigger so it can run with repository secrets when external contributors’ fork PRs are merged, preventing silent failures of the changelog auto-fill step.

Changes:

• Switch workflow trigger from pull_request to pull_request_target for closed events targeting master.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.