From e0cbcd6239de174da6632895568594e1732cb206 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Thu, 17 Oct 2024 13:03:34 +1100
Subject: [PATCH] [8.x] github-actions: pull_request in forked PRs cannot
 change permissions scope (#196550) (#196623)

# Backport

This will backport the following commits from `main` to `8.x`:
- [github-actions: pull_request in forked PRs cannot change permissions
scope (#196550)](https://github.com/elastic/kibana/pull/196550)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Victor
Martinez","email":"victormartinezrubio@gmail.com"},"sourceCommit":{"committedDate":"2024-10-17T01:33:19Z","message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:all-open"],"title":"github-actions:
pull_request in forked PRs cannot change permissions
scope","number":196550,"url":"https://github.com/elastic/kibana/pull/196550","mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/196550","number":196550,"mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}}]}]
BACKPORT-->

Co-authored-by: Victor Martinez <victormartinezrubio@gmail.com>
---
 .github/workflows/oblt-github-commands.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/oblt-github-commands.yml b/.github/workflows/oblt-github-commands.yml
index 48df40f3343d9..1b475334bd80f 100644
--- a/.github/workflows/oblt-github-commands.yml
+++ b/.github/workflows/oblt-github-commands.yml
@@ -8,19 +8,20 @@
 name: oblt-github-commands
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - labeled
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   comment:
     if: ${{ github.event.label.name == 'ci:project-deploy-observability' }}
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with: