Triggering Events Deep Dive

The triggers that get teams in trouble

Beyond push and pull_request, several event types have subtleties worth knowing — most teams discover them after an outage.

`pull_request` vs `pull_request_target`

pull_request runs in the context of the fork's code with no secrets. Safe.
pull_request_target runs in the context of the base repo with full secrets. Dangerous if you check out PR code in such a workflow — that's the classic 'pwn-request' vulnerability.
Use pull_request_target only for: labelling, posting comments, computing metrics — never for running PR-author code.

`schedule`

UTC always.
Disabled on inactive repos (no commits in 60 days).
Drift: GitHub may delay scheduled runs at peak. Don't rely on millisecond accuracy.

`workflow_dispatch`

Inputs are typed: string (default), boolean, choice, environment.
Default values must be specified for required inputs in some UI flows.
Useful for: manual deploys, one-off backfills, ad-hoc fixes.

`workflow_run`

Run a workflow when another workflow finishes.
Use case: post-CI deploy, comment summary, forwarder.
Inherits secrets from the base repo even on forks — careful.

Code

workflow_dispatch with typed inputs·yaml

on:
  workflow_dispatch:
    inputs:
      env:
        description: Target environment
        type: choice
        options: [staging, production]
        default: staging
        required: true
      dry-run:
        description: Dry run (no real deploy)
        type: boolean
        default: true
      version:
        description: Version tag to deploy (e.g., v1.4.2)
        type: string
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "Deploying ${{ inputs.version }} to ${{ inputs.env }}"
          if ${{ inputs.dry-run }}; then echo 'DRY RUN'; fi

Triggering Events Deep Dive

The triggers that get teams in trouble

`pull_request` vs `pull_request_target`

`schedule`

`workflow_dispatch`

`workflow_run`

Code

External links

Exercise

Progress

Comments 0

The triggers that get teams in trouble

pull_request vs pull_request_target

schedule

workflow_dispatch

workflow_run

Code

External links

Exercise

Progress

`pull_request` vs `pull_request_target`

`schedule`

`workflow_dispatch`

`workflow_run`