Merge remote-tracking branch 'origin/dev' into dev

Author: profvjreddi

.github/workflows/all-contributors-auto-credit.yml

@@ -18,7 +18,17 @@ name: '🔧 Infra · 🤖 All Contributors Auto-credit on Merge'
 #                       a "please clarify" comment if either is unknown
 #
 # Triggers:
-#   - pull_request: closed (and merged == true)
+#   - pull_request_target: closed (and merged == true)
+#
+# Why pull_request_target (not pull_request):
+#   For PRs from forks, the GITHUB_TOKEN on `pull_request` is read-only — the
+#   declared `pull-requests: write` in this workflow is silently ignored, and
+#   the comment POST returns 403. `pull_request_target` runs in the base-repo
+#   context with the full token, which is exactly what we need.
+#
+#   This is safe here: we never check out fork code (sparse checkout pulls
+#   from dev only) and the LLM prompt only ingests title/body/file-paths as
+#   data — there is no shell eval of fork-controlled input.
 #
 # Related:
 #   - all-contributors-add.yml   — fires on the comment we post
@@ -28,7 +38,7 @@ name: '🔧 Infra · 🤖 All Contributors Auto-credit on Merge'
 # =============================================================================
 
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
 
 env: