[8.16] github-actions: pull_request in forked PRs cannot change permi…

…ssions scope (elastic#196550) (elastic#196631)

# Backport

This will backport the following commits from `main` to `8.16`:
- [github-actions: pull_request in forked PRs cannot change permissions
scope (elastic#196550)](elastic#196550)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Victor
Martinez","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-17T01:33:19Z","message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(elastic#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","v8.1.4","backport:all-open","v8.16.0","v8.14.4","backport:version","v8.15.3"],"title":"github-actions:
pull_request in forked PRs cannot change permissions
scope","number":196550,"url":"https://github.com/elastic/kibana/pull/196550","mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(elastic#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}},"sourceBranch":"main","suggestedTargetBranches":["8.1","8.14"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/196550","number":196550,"mergeCommit":{"message":"github-actions:
pull_request in forked PRs cannot change permissions scope
(elastic#196550)","sha":"4b09db32f4da6e02068c7888d1888242129eec88"}},{"branch":"8.1","label":"v8.1.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/196623","number":196623,"state":"MERGED","mergeCommit":{"sha":"e0cbcd6239de174da6632895568594e1732cb206","message":"[8.x]
github-actions: pull_request in forked PRs cannot change permissions
scope (elastic#196550) (elastic#196623)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.x`:\n- [github-actions: pull_request
in forked PRs cannot change permissions\nscope
(elastic#196550)](https://github.com/elastic/kibana/pull/196550)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Victor\nMartinez\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-10-17T01:33:19Z\",\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.16.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"release_note:skip\",\"v9.0.0\",\"backport:all-open\"],\"title\":\"github-actions:\npull_request
in forked PRs cannot change
permissions\nscope\",\"number\":196550,\"url\":\"https://github.com/elastic/kibana/pull/196550\",\"mergeCommit\":{\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/196550\",\"number\":196550,\"mergeCommit\":{\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\"}}]}]\nBACKPORT-->\n\nCo-authored-by:
Victor Martinez
<[email protected]>"}},{"branch":"8.14","label":"v8.14.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.15","label":"v8.15.3","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/196622","number":196622,"state":"MERGED","mergeCommit":{"sha":"78986c3f6c87dd04136b1ecd9e2c3d2366da9979","message":"[8.15]
github-actions: pull_request in forked PRs cannot change permissions
scope (elastic#196550) (elastic#196622)\n\n# Backport\n\nThis will backport the
following commits from `main` to `8.15`:\n- [github-actions:
pull_request in forked PRs cannot change permissions\nscope
(elastic#196550)](https://github.com/elastic/kibana/pull/196550)\n\n<!---
Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the
[Backport
tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT
[{\"author\":{\"name\":\"Victor\nMartinez\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-10-17T01:33:19Z\",\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.16.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"release_note:skip\",\"v9.0.0\",\"backport:all-open\"],\"title\":\"github-actions:\npull_request
in forked PRs cannot change
permissions\nscope\",\"number\":196550,\"url\":\"https://github.com/elastic/kibana/pull/196550\",\"mergeCommit\":{\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/196550\",\"number\":196550,\"mergeCommit\":{\"message\":\"github-actions:\npull_request
in forked PRs cannot change permissions
scope\n(elastic#196550)\",\"sha\":\"4b09db32f4da6e02068c7888d1888242129eec88\"}}]}]\nBACKPORT-->\n\nCo-authored-by:
Victor Martinez <[email protected]>"}}]}] BACKPORT-->

Co-authored-by: Victor Martinez <[email protected]>

.github/workflows/oblt-github-commands.yml

@@ -8,19 +8,20 @@
 name: oblt-github-commands
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - labeled
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   comment:
     if: ${{ github.event.label.name == 'ci:project-deploy-observability' }}
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with: