ctreatma · Nov 9, 2026 · Nov 9, 2026
diff --git a/.github/workflows/equinix-validate-pr-comment.yaml b/.github/workflows/equinix-validate-pr-comment.yaml
@@ -0,0 +1,68 @@
+name: "Validate PR comment"
+
+# Posts (or clears) the PR title validation comment. Runs in the context of the
+# default branch with a write token, so it must never check out or execute PR code.
+# The only data taken from the PR is a validated PR number and the error text, which
+# is only rendered as a comment body.
+on:
+  workflow_run:
+    workflows: ["Validate PR"]
+    types:
+      - completed
+
+permissions:
+  actions: read
+  pull-requests: write
+
+jobs:
+  comment:
+    name: Comment on PR title validation
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request'
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: validation-result
+          path: validation-result
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read validation result
+        id: result
+        run: |
+          pr_number=$(tr -cd '0-9' < validation-result/pr-number)
+          if [ -z "$pr_number" ]; then
+            echo "Missing PR number" >&2
+            exit 1
+          fi
+          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
+          if [ -s validation-result/error-message ]; then
+            {
+              echo "Hey there and thank you for opening this pull request! 👋🏼"
+              echo
+              echo "We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted."
+              echo
+              echo "Details:"
+              echo
+              echo '```'
+              cat validation-result/error-message
+              echo
+              echo '```'
+            } > validation-result/comment.md
+            echo "failed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        if: steps.result.outputs.failed == 'true'
+        with:
+          header: pr-title-lint-error
+          number: ${{ steps.result.outputs.pr_number }}
+          path: validation-result/comment.md
+
+      # Delete a previous comment when the issue has been resolved
+      - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        if: steps.result.outputs.failed != 'true'
+        with:
+          header: pr-title-lint-error
+          number: ${{ steps.result.outputs.pr_number }}
+          delete: true
diff --git a/.github/workflows/equinix-validate-pr.yaml b/.github/workflows/equinix-validate-pr.yaml
@@ -1,45 +1,48 @@
 name: "Validate PR"
 
+# Runs with the unprivileged `pull_request` trigger so no write token or secrets
+# are exposed to PR-controlled input. Commenting on the PR is handled by
+# equinix-validate-pr-comment.yaml, which runs via `workflow_run`.
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - synchronize
+      - reopened
 
 permissions:
-  pull-requests: write
+  contents: read
+  pull-requests: read
 
 jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@2252a14e810aa9b85c2d560bd7070c802206ecf6 # v6.1.2
         id: lint_pr_title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: marocchino/sticky-pull-request-comment@v2
-        # When the previous steps fails, the workflow would stop. By adding this
-        # condition you can continue the execution with the populated error message.
-        if: always() && (steps.lint_pr_title.outputs.error_message != null)
-        with:
-          header: pr-title-lint-error
-          message: |
-            Hey there and thank you for opening this pull request! 👋🏼
-
-            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.
-
-            Details:
-
-            ```
-            ${{ steps.lint_pr_title.outputs.error_message }}
-            ```
-
-      # Delete a previous comment when the issue has been resolved
-      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
-        uses: marocchino/sticky-pull-request-comment@v2
+      # Hand the result to the commenting workflow. The error message derives from the
+      # PR title, so it is passed via env and written to a file, never interpolated
+      # into the script.
+      - name: Write validation result
+        if: always()
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          ERROR_MESSAGE: ${{ steps.lint_pr_title.outputs.error_message }}
+        run: |
+          mkdir -p validation-result
+          printf '%s' "$PR_NUMBER" > validation-result/pr-number
+          if [ -n "$ERROR_MESSAGE" ]; then
+            printf '%s' "$ERROR_MESSAGE" > validation-result/error-message
+          fi
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
         with:
-          header: pr-title-lint-error
-          delete: true
+          name: validation-result
+          path: validation-result
+          retention-days: 1