fix: add-to-triage does not work on PRs from fork

[lumirlumir]

Prerequisites checklist

• I have read the contributing guidelines.

What is the purpose of this pull request?

Hi,

In this PR, I've fixed the issue where the add-to-triage workflow wasn't working on PRs from forks.

The workflow works for members who have direct access to create branches, but it doesn't work for forked repositories.

Currently, this problem arises in the Markdown repository when contributors make contributions.

https://github.com/eslint/markdown/actions/runs/16787402125/job/47558666610?pr=500

---

I've found the solution for this at the link below:

actions/add-to-project#422

We need to use the pull_request_target event instead of the pull_request event to ensure it works with forked repositories.

---

The difference between pull_request_target and pull_request is:

• The pull_request event runs in the PR's HEAD branch. So, if I'm working on the lumirlumir/markdown repository, the workflow runs on that repository, and contributors never have access to the token information since their forked repository doesn't have the secret key.

• The pull_request_target event runs in the main branch of the original repository. So, even if I'm working on the lumirlumir/markdown repository, the workflow runs in the main branch of the eslint/markdown repository. This way, contributors can benefit from the workflow because the secret key exists in the eslint/markdown repository.

From my research, this seems to be the common pattern for allowing workflows to run even in forked repositories.

The reason other workflows work fine, but this one caused an error, is that this workflow requires secret information that's set by the ESLint organization.

What changes did you make? (Give an overview)

I've updated the event from pull_request to pull_request_target.

Related Issues

N/A

Is there anything you'd like reviewers to focus on?

This fix only applies to this repository, since the workflow event should be set at the repository level.

My plan is to test whether it works as expected here first, and then create a fix PR when I set up the stale.yml workflow in each repository.

---

I should have checked more carefully—sorry for causing repetitive work.

[lumirlumir]

Here is a guide for pull_request_target event:

https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target

Also, pull_request event:

https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request

[lumirlumir]

The add-to-triage workflow isn’t working as expected here, since pull_request_target only takes effect once it’s merged and in the main branch.

[lumirlumir]

I’ve also updated PROJECT_BOT_TOKEN to project_bot_token for consistency, since the GitHub example uses lowercase as well. (af8cd1e)

[nzakas]

LGTM. Thanks!