[doublebyte1]

Overview

Workflows triggered by Pull Requests from forks to the upstream repository don't have access to secrets for security reasons. However, workflows triggered by pull_request_target can access secrets. To make them secure, we need to put some safeguards in place by hardening the restrictions and making sure they never checkout or run the PR code. In this case we only access the PR url, to pass it as an argument to the classifier script.

Related Issue / discussion

#2461

Additional information

https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target

Dependency policy (RFC2)

• I have ensured that this PR meets RFC2 requirements

Updates to public demo

• I have ensured that breaking changes to the pygeoapi master demo server have been addressed
  • https://github.com/geopython/demo.pygeoapi.io/blob/master/services/pygeoapi_master/local.config.yml

Contributions and licensing

(as per https://github.com/geopython/pygeoapi/blob/master/CONTRIBUTING.md#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to pygeoapi. I confirm that my contributions to pygeoapi will be compatible with the pygeoapi license guidelines at the time of contribution
• I have already previously agreed to the pygeoapi Contributions and Licensing Guidelines