From 5ea91829dcaee92873b5a66c09ef45febb7ceb46 Mon Sep 17 00:00:00 2001
From: Michael Recachinas <mrecachinas@github.com>
Date: Tue, 11 Aug 2026 10:58:43 -0400
Subject: [PATCH 1/2] Migrate close-on-PR workflow off pull_request_target

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/auto-close-pr-writer.yml | 58 ++++++++++++++++++++++
 .github/workflows/auto-close-pr.yml        | 21 +++-----
 2 files changed, 65 insertions(+), 14 deletions(-)
 create mode 100644 .github/workflows/auto-close-pr-writer.yml

diff --git a/.github/workflows/auto-close-pr-writer.yml b/.github/workflows/auto-close-pr-writer.yml
new file mode 100644
index 00000000..c8255c49
--- /dev/null
+++ b/.github/workflows/auto-close-pr-writer.yml
@@ -0,0 +1,58 @@
+name: Auto-close PR writer
+
+on:
+  workflow_run:
+    workflows: [Auto-close PR]
+    types: [completed]
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  close:
+    name: Run
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+          COMMENT_BODY: |
+            At the moment we are not accepting contributions to the repository.
+            
+            Feedback for GitHub Copilot for Xcode can be given in the [Copilot community discussions](https://github.com/github/CopilotForXcode/discussions).
+        run: |
+          set -euo pipefail
+
+          if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then
+            PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')"
+          fi
+
+          if [ -z "${PR_NUMBER:-}" ]; then
+            echo "Unable to identify a single open PR for workflow run; skipping."
+            exit 0
+          fi
+
+          pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)"
+          if [ "$pr_state" != "open" ]; then
+            echo "PR #$PR_NUMBER is $pr_state; skipping."
+            exit 0
+          fi
+
+          head_repo="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.head.repo.full_name // ""')"
+          head_ref="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .head.ref)"
+          if [ "$head_repo" = "$GH_REPO" ] && [[ "$head_ref" == release/* ]]; then
+            echo "PR #$PR_NUMBER is from allowed release branch $head_ref in $head_repo; skipping."
+            exit 0
+          fi
+
+          gh api -X POST "repos/$GH_REPO/issues/$PR_NUMBER/comments" -f body="$COMMENT_BODY"
+          gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed
diff --git a/.github/workflows/auto-close-pr.yml b/.github/workflows/auto-close-pr.yml
index 90beda84..547293bc 100644
--- a/.github/workflows/auto-close-pr.yml
+++ b/.github/workflows/auto-close-pr.yml
@@ -1,21 +1,14 @@
 name: Auto-close PR
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, reopened]
 
+permissions:
+  pull-requests: read
+
 jobs:
-  close:
-    name: Run
+  signal:
+    name: Signal
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     steps:
-      - run: |
-          gh pr close ${{ github.event.pull_request.number }} --comment \
-          "At the moment we are not accepting contributions to the repository.
-
-          Feedback for GitHub Copilot for Xcode can be given in the [Copilot community discussions](https://github.com/github/CopilotForXcode/discussions)."
-        if: ${{ !(startsWith(github.head_ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository) }}
-        env:
-          GH_REPO: ${{ github.repository }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: echo "Auto-close signal for PR #${{ github.event.pull_request.number }}"

From 6c95bc19b048020bbc3a0d3aa6fff325e7eae3d3 Mon Sep 17 00:00:00 2001
From: Michael Recachinas <mrecachinas@github.com>
Date: Tue, 11 Aug 2026 11:10:44 -0400
Subject: [PATCH 2/2] Trim auto-close PR writer permissions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/auto-close-pr-writer.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/auto-close-pr-writer.yml b/.github/workflows/auto-close-pr-writer.yml
index c8255c49..7284ac31 100644
--- a/.github/workflows/auto-close-pr-writer.yml
+++ b/.github/workflows/auto-close-pr-writer.yml
@@ -6,7 +6,6 @@ on:
     types: [completed]
 
 permissions:
-  issues: write
   pull-requests: write
 
 jobs: