ci(trunk): upload impacted targets with fork-aware auth so fork PRs can enter the merge queue

[gantoine]

Problem

Fork PRs can't be merged through the Trunk parallel merge queue and have to be merged by hand — e.g. #2819, which Trunk logged as "😎 Merged manually" and landed via GitHub auto-squash, with no Trunk Merge Queue check ever running.

Trunk needs an impacted-targets upload to place a PR into a queue lane. That upload authenticates with the org API token (x-api-token = secrets.TRUNK_API_TOKEN), but GitHub withholds repo secrets from pull_request runs originating in a fork, so fork PRs can never make that call. The repo had no impacted-targets upload at all (only the flaky-test analytics-uploader).

Per the Trunk team: "add a x-forked-workflow-run-id header to the request to upload impacted targets for your parallel queue from forked PRs."

Change

New workflow .github/workflows/trunk-impacted-targets.yml that POSTs to /v1/setImpactedTargets on every PR:

• Internal PRs → x-api-token: ${{ secrets.TRUNK_API_TOKEN }}
• Fork PRs → x-forked-workflow-run-id: ${{ github.run_id }} (no secret required)

Details:

• Fork detection reuses the same expression as the existing e2e job (head.repo.full_name != github.repository).
• Request body matches Trunk's schema (repo{host,owner,name}, pr{number,sha}, targetBranch, impactedTargets), built with jq from env-passed context (no untrusted PR data interpolated into the shell). Uses the PR head SHA so it matches the run's head_sha for Trunk's fork verification.
• Reports impactedTargets: "ALL" — always correct (never under-reports), gets forks into the queue; a computed target list for real parallelism is left as a documented TODO in the file.
• Fails loudly (no continue-on-error) with retries — a silent upload failure is exactly what kept fork PRs out of the queue.
• Stays on the pull_request trigger, never pull_request_target, so no secret is exposed to fork code ("pwn request").

Ref: https://docs.trunk.io/merge-queue/optimizations/parallel-queues/api#handling-forked-pull-requests

Verification

• YAML parses; on/jobs/concurrency/permissions as intended.
• Smoke-tested the shell block with sample values: jq payload is schema-correct (pr.number is a JSON number) and the auth header switches correctly between fork/internal.
• Server-side acceptance of a fork upload can only be observed once a real fork PR runs this workflow — suggest watching the next fork PR to confirm it now enters the queue.

---

Created with PostHog Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[greptile-apps]

_{Reviews (1): Last reviewed commit: "ci(trunk): upload impacted targets with ..." | Re-trigger Greptile}