From fd4d24ff62e01f0ec28124bff062c3fac81e9bde Mon Sep 17 00:00:00 2001
From: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
Date: Fri, 22 May 2026 18:43:46 -0400
Subject: [PATCH] Guard require-issue-link check job to pull_request_target
 events (#4209)

---
 .github/workflows/require-issue-link.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/require-issue-link.yml b/.github/workflows/require-issue-link.yml
index 0e7d6e68b..044d4f9cd 100644
--- a/.github/workflows/require-issue-link.yml
+++ b/.github/workflows/require-issue-link.yml
@@ -57,10 +57,16 @@ jobs:
     # then the script resolves the author's real permission and exits early
     # for maintainers.
     #
-    # Gate: skip drafts, bots, and already-bypassed/trusted PRs. Allow the
-    # primary actions plus the one maintainer-override action we care about
-    # (removing the missing-issue-link label).
+    # Gate: only run on pull_request_target events. The workflow also listens
+    # to `issues.assigned` (handled by reopen-on-assignment below), and without
+    # this guard the job would also fire there — `github.event.pull_request` is
+    # null on an issues event, so `...draft == false` coerces to true and the
+    # script then dereferences a missing PR and crashes. Beyond the event type,
+    # skip drafts, bots, and already-bypassed/trusted PRs, and allow the primary
+    # actions plus the one maintainer-override action we care about (removing
+    # the missing-issue-link label).
     if: >-
+      github.event_name == 'pull_request_target' &&
       github.event.pull_request.draft == false &&
       !endsWith(github.actor, '[bot]') &&
       !contains(github.event.pull_request.labels.*.name, 'trusted-contributor') &&