ticket-3517845

Given:

• Repository with default branch main (this repo)
• A workflow on main with the following:

on:
    pull_request_target:
        types: [opened, edited] # Could be anything, this one is easy to test

jobs:
    job-with-env:
        runs-on: ubuntu-latest
        environment: main
        steps:
            - run: |
                echo "${{ github.ref }}"
                echo "${{ github.sha }}"
    job-without-env:
        runs-on: ubuntu-latest
        steps:
            - run: |
                echo "${{ github.ref }}"
                echo "${{ github.sha }}"

• Repository Environment main-env which is configured to have deployment branch main:

• A Pull Request opened against main (on the same repo)

Then

• The job without the environment runs and echos the expected context of using refs/heads/main (showing the workflow is running in the context of main)
• The job with the environment fails with:

Branch "thejcannon-patch-3" is not allowed to deploy to main due to environment protection rules.

I suspect the nuance here is that the "triggering event"'s head branch/ref is being used, as evidenced by the API data for the run:

$ gh api /repos/thejcannon/ticket-3517845/actions/runs/16054386573 --jq '.head_branch'
thejcannon-patch-1

Expectation

Since the pull_request_target workflows runs in the context of the base branch (main), I'd expect to run the job targeting the environment which is configured for main to succeed.