From 635571b00b1318280d71a53ce3d886dd3bc1c11f Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Sun, 2 Aug 2026 18:35:02 -0300
Subject: [PATCH] fix(ci): request reviews safely for fork PRs

---
 .github/workflows/copilot-review.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/copilot-review.yml b/.github/workflows/copilot-review.yml
index 54db1498..8afdb03e 100644
--- a/.github/workflows/copilot-review.yml
+++ b/.github/workflows/copilot-review.yml
@@ -1,11 +1,15 @@
 name: Request Copilot Review
 
 on:
-  pull_request:
+  # This workflow never checks out or executes pull-request code. Using the
+  # base-repository context is therefore safe and is required for cross-fork
+  # PRs, whose pull_request GITHUB_TOKEN is always downgraded to read-only.
+  pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
 
 jobs:
   request-copilot-review:
+    if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write