Populate Changelog fails for every pull request from a fork

[thc1006]

Describe the bug

Populate Changelog fails for every pull request opened from a fork, and only for those.

on:
  pull_request:
    types: [closed]
    branches:
      - develop

GitHub does not pass secrets to a pull_request workflow when the head is a fork, so secrets.RELEASE_TOKEN is empty and the first step stops:

##[error]Input required and not supplied: token

The job goes red after five seconds, and since nothing else refers to the changelog, the merge completes and the entry is simply absent.

To Reproduce

Recent merges into develop, by where the branch lived:

#1097  fork (thc1006)      failure
#1070  fork (zuorenchen)   failure
#1052  fork (thc1006)      failure

#1079  RocketPy-Team       success
#1082  RocketPy-Team       success
#1056  RocketPy-Team       success

The split is clean in both directions across every run I can still see.

Expected behavior

The entry is written whoever the contributor is.

This is not losing history, and I want to be accurate about the size of it. Both older cases were caught by hand:

• ENH: seed sensor measurement noise per instance #1052 merged on 07-11, entry added on 07-12 in ba9d130
• ENH: Add optional max time to stochastic_flight and create stochastic_flight objects with attributes in base flight #1070 merged on 07-19, entry added the same day in d31822d under "changelog consolidation" while preparing v1.13.0

So what it actually costs is somebody noticing, once per external contribution, and often not until a release is being assembled. #1097 merged this morning and is missing now, which is what sent me looking.

pull_request_target would fix it, and unusually for that trigger it is safe here. The job never touches the contributor's branch: it checks out RocketPy-Team/RocketPy at ref: develop and runs .github/scripts/update_changelog.py from that same trusted tree. There is no head.sha or head.ref anywhere in the file, so nothing from the pull request is executed.

on:
  pull_request_target:
    types: [closed]
    branches:
      - develop

github.event.pull_request keeps the same shape, so PR_NUMBER and the merged == true guard carry over unchanged.

If you would rather not use that trigger at all, on: push: branches: [develop] also gets secrets, at the cost of working out which pull request the push came from.

Additional context

Worth saying that this lands on outside contributions specifically, which are the ones where a changelog line does the most good and where the contributor is least likely to know it went missing.

7f85c072 from April is titled "DEV: correct auto-changelog access token", so the token has had attention before. This looks like a different failure to that one, but I have not gone back to check what that commit was fixing.

Happy to send the one-line PR.

Verified against develop at 2cca437.

Signed-off-by: thc1006 84045975+thc1006@users.noreply.github.com