Commit 4d0406f3a9a for woocommerce

commit 4d0406f3a9ac3fea7286837a67934e84b69b7e3b
Author: Seun Olorunsola <30554163+triple0t@users.noreply.github.com>
Date:   Tue Aug 11 16:46:34 2026 +0100

    Post the email editor test reminder on fork pull requests (#67628)

    * Post the email editor test reminder on fork pull requests

    The "Email Editor Test Reminder" job fails on any pull request opened from
    a fork that touches packages/php/email-editor. It runs on pull_request, so
    a fork gets a read-only GITHUB_TOKEN, and the permissions block cannot
    raise it. Posting the comment then fails with a 403.

    Switch the trigger to pull_request_target, which runs in the base repo
    context and gets a write token for fork pull requests. This is the same
    pattern changelog-auto-add.yml and docs-needed-detection.yml already use.

    The job holds a write token, so checkout is now pinned to the base commit.
    It was already the default, but making it explicit keeps a later edit from
    pulling in pull request code by accident. Nothing in this workflow reads,
    builds, or runs anything from the fork.

    Both helper scripts work unchanged: they only use context.repo and
    context.issue.number, and both are the same under either trigger.

    * Keep the checkout token out of the local git config

    actions/checkout defaults persist-credentials to true, which writes the
    token into .git/config. This job holds a write token and no later step
    runs git, so there is no reason to keep it around.

    Matches docs-needed-detection.yml, which sets the same on its
    pull_request_target checkout.

diff --git a/.github/workflows/pr-email-editor-test-reminder.yml b/.github/workflows/pr-email-editor-test-reminder.yml
index bda3abf9524..620c564fa00 100644
--- a/.github/workflows/pr-email-editor-test-reminder.yml
+++ b/.github/workflows/pr-email-editor-test-reminder.yml
@@ -1,7 +1,12 @@
 name: Email Editor Test Reminder

+# Runs on `pull_request_target` rather than `pull_request` so it also works for
+# pull requests opened from a fork. On `pull_request` a fork gets a read-only
+# token, which a `permissions:` block cannot raise, so posting the reminder
+# comment fails with a 403. This workflow only ever checks out and runs base
+# branch code, so it never executes anything a fork controls.
 on:
-    pull_request:
+    pull_request_target:
         types: [opened, synchronize, reopened]

 concurrency:
@@ -19,6 +24,13 @@ jobs:
         steps:
             - name: Checkout
               uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  # Check out the base branch, never the pull request head. The job
+                  # holds a write token, so it must not run code from the PR.
+                  ref: ${{ github.event.pull_request.base.sha }}
+                  # Keep the token out of the local git config. No later step runs
+                  # git, so nothing here needs it.
+                  persist-credentials: false

             - name: Setup Node
               uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0