[CI] Review pull_request_target workflow triggers

[thisisnic]

Describe the enhancement

Several workflows use pull_request_target as a trigger. This trigger runs in the context of the base branch and has access to secrets, which requires careful handling. These workflows should be reviewed to ensure they follow best practices.

Affected files

• .github/workflows/dev_pr.yml
• .github/workflows/pr_bot.yml
• .github/workflows/pr_review_trigger.yml

Component(s)

Continuous Integration

[thisisnic]

I think this one is a false positive as they all have persist-credentials set to false and check out the main branch only.

[raulcd]

I agree. Thanks @thisisnic for taking a look into those!