I think the PR triage workflow needs to use `pull_request_target` so it works for PRs originating from forks.