Bug: github.event.repository.fork check is ineffective in pull_request_target workflows

[mabrukhany-beep]

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

The condition if: github.event.repository.fork == false used in the assistant-to-the-branch-manager.yml workflow is semantically incorrect when used with the pull_request_target trigger.

In pull_request_target context, github.event.repository always refers to the base repository (angular/components), never the fork. Therefore, this condition is always false (evaluates to true, allowing execution) even for pull requests originating from forks.

While the current composite actions are safe (Node24 runtime, no shell sinks), this condition provides false security and could mask the risk if any future run step is added that processes untrusted PR inputs.

This was identified during a security review of Angular's GitHub Actions configuration. Google OSS VRP previously identified a supply-chain vulnerability in the Angular ecosystem (March 2026) involving the ANGULAR_ROBOT_PRIVATE_KEY credential exposed through pull_request_target workflows. Fixing this condition reduces the attack surface for similar issues.

Reproduction

StackBlitz link: N/A - This is a CI/CD configuration issue, not a component runtime bug
Steps to reproduce:

1. Fork the angular/components repository
2. Create a pull request from the fork to angular/components:main
3. Observe that the "Assistant to the Branch Manager" workflow triggers automatically
4. The workflow executes successfully despite the condition if: github.event.repository.fork == false

Expected Behavior

The if: github.event.repository.fork == false condition should prevent fork-originated pull requests from triggering the assistant_to_the_branch_manager job when the workflow runs on pull_request_target events.

Actual Behavior

The assistant_to_the_branch_manager job runs successfully on fork-originated pull requests because github.event.repository in pull_request_target always refers to the base repository (angular/components), which is never a fork. Therefore, github.event.repository.fork is always false and the condition always evaluates to true.

Environment

• Angular: N/A
• CDK/Material: N/A
• Browser(s): N/A
• Operating System: N/A
• Repository: angular/components
• Affected workflow: .github/workflows/assistant-to-the-branch-manager.yml

[mabrukhany-beep]

Related harmless PoC confirming the behavior: #33631