Replace the `pull_request_target` + `safe-to-test` label mechanism with `pull_request_review` (submitted, approved). External contributor PRs now get basic builds/lints on open, and full secret-dependent CI only after a maintainer approves — no manual labeling needed. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| dependabot.yml | ||