Automate release manifest refresh for trusted PRs

.github/workflows/baseline.yml

@@ -34,5 +34,8 @@ jobs:
       - name: Install website dependencies
         run: npm ci --prefix website
 
+      - name: Regenerate release manifest for verification
+        run: npm run build:release-manifest
+
       - name: Verify inherited product baseline
         run: npm run check

.github/workflows/refresh-release-manifest.yml

@@ -2,21 +2,34 @@ name: Refresh release manifest
 
 on:
   workflow_dispatch:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
   actions: write
   contents: write
+  pull-requests: read
+
+concurrency:
+  group: release-manifest-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   refresh:
-    if: github.ref_name != github.event.repository.default_branch
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref_name != github.event.repository.default_branch) ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association))
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    env:
+      TARGET_REF: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.ref || github.ref_name }}
     steps:
-      - name: Check out the selected branch
+      - name: Check out the target branch
         uses: actions/checkout@v7
         with:
-          ref: ${{ github.ref_name }}
+          ref: ${{ env.TARGET_REF }}
           fetch-depth: 0
 
       - name: Set up pinned Node.js and npm
@@ -59,21 +72,22 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add reports/release-manifest-v1.json
           git commit -m "Refresh release manifest from exact branch bytes"
-          git push origin "HEAD:${GITHUB_REF_NAME}"
+          git push origin "HEAD:${TARGET_REF}"
           echo "changed=true" >> "$GITHUB_OUTPUT"
 
       - name: Dispatch Baseline Verification on the updated branch
+        if: steps.commit.outputs.changed != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh workflow run baseline.yml --ref "${GITHUB_REF_NAME}"
+        run: gh workflow run baseline.yml --ref "${TARGET_REF}"
 
       - name: Summarize
         run: |
           {
             echo "## Release manifest refreshed"
             echo
-            echo "- Branch: ${GITHUB_REF_NAME}"
+            echo "- Branch: ${TARGET_REF}"
             echo "- Report changed: ${{ steps.commit.outputs.changed }}"
             echo "- Full check: passed"
-            echo "- Baseline Verification: dispatched"
+            echo "- Baseline Verification: ${{ steps.commit.outputs.changed == 'true' && 'will run from the pushed commit' || 'dispatched' }}"
           } >> "$GITHUB_STEP_SUMMARY"