From a9b3876226d205f929596fc136ea0ebddf0131f0 Mon Sep 17 00:00:00 2001
From: Felix Exner <feex@universal-robots.com>
Date: Tue, 3 Nov 2026 10:14:34 +0100
Subject: [PATCH] Change event of create_release workflow

If we act on the pull_request event from a forked source (which is how
we usually do release PRs), the workflow's permissions are downgraded to
read-only. Changing that to the pull_request_target event should fix
that.
---
 .github/workflows/create_release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
index 86a9c9c77..7e9447e1e 100644
--- a/.github/workflows/create_release.yml
+++ b/.github/workflows/create_release.yml
@@ -1,7 +1,8 @@
 name: Create release
 
 on:
-  pull_request:
+  # pull_request tokens are read-only for fork-based release PRs.
+  pull_request_target:
     types: [closed]
     branches:
       - master
@@ -18,6 +19,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Read version from package.xml
         id: version