Migrate pull request automation away from pull_request_target

.github/workflows/auto-close-pr-writer.yml

@@ -0,0 +1,57 @@
+name: Auto-close PR writer
+
+on:
+  workflow_run:
+    workflows: [Auto-close PR]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  close:
+    name: Run
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+          COMMENT_BODY: |
+            At the moment we are not accepting contributions to the repository.
+
+            Feedback for GitHub Copilot for Xcode can be given in the [Copilot community discussions](https://github.com/github/CopilotForXcode/discussions).
+        run: |
+          set -euo pipefail
+
+          if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then
+            PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')"
+          fi
+
+          if [ -z "${PR_NUMBER:-}" ]; then
+            echo "Unable to identify a single open PR for workflow run; skipping."
+            exit 0
+          fi
+
+          pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)"
+          if [ "$pr_state" != "open" ]; then
+            echo "PR #$PR_NUMBER is $pr_state; skipping."
+            exit 0
+          fi
+
+          head_repo="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.head.repo.full_name // ""')"
+          head_ref="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .head.ref)"
+          if [ "$head_repo" = "$GH_REPO" ] && [[ "$head_ref" == release/* ]]; then
+            echo "PR #$PR_NUMBER is from allowed release branch $head_ref in $head_repo; skipping."
+            exit 0
+          fi
+
+          gh api -X POST "repos/$GH_REPO/issues/$PR_NUMBER/comments" -f body="$COMMENT_BODY"
+          gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed

.github/workflows/auto-close-pr.yml

@@ -1,21 +1,14 @@
 name: Auto-close PR
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, reopened]
 
+permissions:
+  pull-requests: read
+
 jobs:
-  close:
-    name: Run
+  signal:
+    name: Signal
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     steps:
-      - run: |
-          gh pr close ${{ github.event.pull_request.number }} --comment \
-          "At the moment we are not accepting contributions to the repository.
-
-          Feedback for GitHub Copilot for Xcode can be given in the [Copilot community discussions](https://github.com/github/CopilotForXcode/discussions)."
-        if: ${{ !(startsWith(github.head_ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository) }}
-        env:
-          GH_REPO: ${{ github.repository }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: echo "Auto-close signal for PR #${{ github.event.pull_request.number }}"