From edffa978577189940b4e7aedc0895b131f0f4e63 Mon Sep 17 00:00:00 2001
From: Maxerns <maksafk@gmail.com>
Date: Wed, 9 Sep 2026 13:57:29 +0100
Subject: [PATCH] fix greeting workflow hitting 403 for prs when it only gets a
 read only token

---
 .github/workflows/greet.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/greet.yml b/.github/workflows/greet.yml
index fd5fac11..f0df34e5 100644
--- a/.github/workflows/greet.yml
+++ b/.github/workflows/greet.yml
@@ -3,7 +3,10 @@ name: Greet first-time contributors
 on:
   issues:
     types: [opened]
-  pull_request:
+  # pull_request_target, not pull_request: fork PRs get a read-only token under
+  # pull_request, so posting the greeting would 403. Safe: this job only posts a
+  # comment and never checks out PR code.
+  pull_request_target:
     types: [opened]
 
 permissions: