Merge pull request #25 from target/safe-check-for-forks

Separate out diff-poetry-lock workflow with pull_request_target

Author: colindean

.github/workflows/diff-poetry-lock.yaml

@@ -0,0 +1,25 @@
+name: Run diff-poetry-lock safe for forks
+on: # zizmor: ignore[dangerous-triggers] Limitations on checkout safen this.
+  pull_request_target:
+    branches:
+      - main
+    paths:
+      - poetry.lock
+
+permissions: {}
+
+jobs:
+  diff-lockfile-main:
+    runs-on: ubuntu-latest
+    name: Diff poetry.lock
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+          sparse-checkout: poetry.lock
+      - name: Diff poetry.lock
+        uses: | # zizmor: ignore[unpinned-uses] It's safe to use main on our own repo.
+          target/diff-poetry-lock@main