[Akshay Sonawane (apsonawane)]

This pull request updates the extended-pr-validation.yml workflow to improve security and validation checks for pull request events. The main changes are focused on tightening permissions, refining the workflow trigger conditions, and ensuring the correctness of the referenced commit.

Workflow trigger and permissions improvements:

• The workflow now only triggers on pull_request_target events if the pull request is not a draft and originates from the same repository, reducing the risk of running untrusted code from forks.
• The id-token: write permission is moved to the job level, ensuring it's only granted when necessary and not globally.

Validation enhancements:

• Added a step to resolve the actual commit SHA for the source ref and verify that it matches the provided commit, preventing mismatches and potential errors in downstream steps. If the ref does not exist or the commit does not match, the workflow fails early with a clear error message.
• The output for source_commit is now set to the resolved commit SHA, ensuring downstream jobs use the correct commit.

[Copilot]

🟡 Changes recommended

Ref resolution can select the wrong branch or return an annotated tag’s object SHA instead of its commit SHA, causing incorrect expected-commit validation or forwarding an invalid downstream commit ID.

1 open issue

• Resolve source refs exactly and use peeled commit SHAs · New

What changed in this PR

Hardens the workflow that dispatches extended PR validation to the private pipeline, tightening automatic execution and checking manually selected revisions.

Changes:

• Limits automatic dispatch to non-draft PRs from the same repository while retaining manual dispatch.
• Scopes id-token: write permission to the dispatch job.
• Adds remote-ref resolution and commit comparison before forwarding the resolved SHA.

File	Description
.github/​workflows/​extended-pr-validation.yml	Updates dispatch conditions, job permissions, and manual revision validation.

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

The workflow rejects previously supported same-repository PR refs and can dispatch blob or tree IDs as source commits without verifying that they resolve to commits.

1 open issue

• Keep support for same-repository pull request refs · New

1 previously missed issue

In code that hasn't changed since last review

Verify selected refs resolve to commits before dispatch

.github/​workflows/​extended-pr-validation.yml:106

git ls-remote can return a blob or tree ID for a lightweight or annotated tag, which this code then dispatches as source_commit. Fetch the selected ref and verify that it resolves with ^{commit} so invalid revisions fail before reaching the private pipeline.

1 resolved since last review

• Resolve source refs exactly and use peeled commit SHAs

_{Review effort: Max}