[eseidel]

Why

Shorebird's token exchange now refuses GitHub OIDC tokens from pull_request_target runs (shipped to prod 2026-10-23). Such a run carries the base branch's ref (so a rule pinned to refs/heads/main matched it) but can be started by anyone who opens a pull request, including from a fork. The trust-rules page still said a rule doesn't limit which events can start a job; this says that pull_request_target is the exception, notes that a ref pattern doesn't keep out other outsider-startable events (issue_comment, workflow_run), adds the refusal message to "When a sign-in is refused" and the GitHub CI guide, and adds a changelog entry.

What could go wrong

Text only. A customer reading it learns that such workflows can't sign in, which is already the behaviour.

Screenshots

No layout change: text on /account/trust-rules/ and /code-push/ci/github/, plus one changelog entry.

Landing

As soon as approved (the server change is already in prod).

🤖 Generated with Claude Code

[eseidel]

Adversarial review (separate agent, no context from the author; read the diff, the page, and the server change in _shorebird#4104)

The new sentence is accurate: the server refuses event_name == pull_request_target before rule lookup, returns invalid_grant, and it does not overclaim other events.

1. Medium — "When a sign-in is refused" has no entry for the new refusal. The server's error_description ("pull_request_target runs cannot exchange tokens: ...") isn't listed, and nothing says what to do instead. Fix: add a bullet; point to push/release/workflow_dispatch or a service account key.
2. Medium — the paragraph still implies a ref pattern keeps pull requests out. With pull_request_target named as the exception, readers may assume refs/heads/main covers everything else, but issue_comment and workflow_run runs (chained from a fork PR) also carry the default branch's ref and can be triggered by outsiders. Fix: say a ref pattern limits branches, not who starts the run; only an environment with required reviewers keeps out outsider-triggered events.
3. Low — "base branch's ref" may be stale. Since GitHub's Dec 2025 change, pull_request_target runs from the default branch with GITHUB_REF set to it. Fix: "default branch's ref".
4. Low — no changelog entry for a customer-visible behaviour change; src/content/changelog/ records these.
5. Nit — code-push/ci/github.mdx's refusal paragraph doesn't mention it. Optional clause or link.

[eseidel]

Addressed in bee3d18:

1. Fixed: added a "When a sign-in is refused" bullet for pull_request_target runs cannot exchange tokens, pointing to push/release/workflow_dispatch or a service account key.
2. Fixed: the paragraph now says a ref pattern limits the branch, not who started the run, names issue_comment and workflow_run as other outsider-startable default-branch events, and points to an environment with required reviewers.
3. Fixed: "default branch's ref". (The server's error text says "base branch's ref"; the docs quote only the message's start, so it doesn't conflict. Left the server string alone.)
4. Fixed: added src/content/changelog/trust-rules-refuse-pull-request-target.md (area API, type Changed).
5. Fixed: code-push/ci/github.mdx's refusal paragraph now mentions it and links the refusal list.

[eseidel]

Moved to shorebirdtech/_shorebird#4183; docs now live in the monorepo.