Advice for pull_request_target in Github

[MrHinsh]

I have a public repo, and in order to build with secrets I just switched to pull_request_target and GitVersion thinks its on main! (it also jumped a major version, which I don't know why).

Id appreciate any help from someone that has already tried this!

Here’s a table that illustrates the difference in behavior of GitVersion_BranchName when using pull_request vs. pull_request_target in GitHub Actions.

GitHub Action Trigger	GitVersion_BranchName Output Example	Explanation
pull_request	pull/2439/merge	When using pull_request, GitHub Actions runs in the context of the PR branch, hence the branch name will be formatted as pull/{PR number}/merge.
pull_request_target	main	When using pull_request_target, GitHub Actions runs in the context of the base branch (e.g., main), not the PR branch. Therefore, GitVersion_BranchName will be set to main.

Key Differences:

• pull_request: The workflow runs in the context of the pull request (head) branch, and GitVersion_BranchName will be formatted with pull/{PR number}/merge.
• pull_request_target: The workflow runs in the context of the base branch (the branch being targeted by the PR), and GitVersion_BranchName reflects the base branch name, such as main.

This behavior is due to the fact that pull_request_target uses the base branch’s context (which allows access to secrets), while pull_request uses the context of the pull request’s head branch.

Triggers:

on:
  push:
    branches: ["main"]
    tags-ignore: ["v*-*"]
  pull_request_target:
      types: [opened, synchronize, labeled]
      branches: ["main"]

workflow:

- name: Checkout
  uses: actions/checkout@v4
  with:
    repository: ${{ github.event_name == 'push' && github.repository || github.event.pull_request.head.repo.full_name }}
    ref: ${{ github.event_name == 'push' && github.ref || github.event.pull_request.head.ref }}
    fetch-depth: 0
- name: Install GitVersion
  uses: gittools/actions/gitversion/[email protected]
  with:
    versionSpec: '5.x'
    includePrerelease: true
- name: Execute GitVersion
  id: gitversion
  uses: gittools/actions/gitversion/[email protected]
  with:
    useConfigFile: true

Gitversion.yaml

assembly-versioning-scheme: MajorMinorPatch
mode: ContinuousDelivery
continuous-delivery-fallback-tag: 'Canary'
next-version: 16.0.0
branches: 
  main:
      mode: ContinuousDelivery
      tag: 'Preview'
      increment: Patch
      is-mainline: true
      prevent-increment-of-merged-branch-version: false
      tracks-release-branches: true
      regex: ^master$|^main$
  release:
    mode: ContinuousDelivery
    tag: ""
    increment: Patch
    track-merge-target: false
    regex: ^release(s)?[\/-]
    source-branches:
    - master
    - main
    is-release-branch: true
    is-mainline: false
ignore:
  sha: []
merge-message-formats: {}