Pascal

GH doesn't let me clone my own repository, so I cannot quickly test this right now. Could you possibly adapt your actions workflow file to enable tracing and then try...

Yeah, that was a bug because I used `pullRequest.head...` where instead `pullRequest.base...` should have been used! This should be fixed in the latest version, you can try it like ```yaml...

I would definitely recommend against using `latest`. We did that once accidentally for another action (provided by GH) and the API of that action changed, without us noticing, breaking our...

I'm afraid that's a general problem with GH actions and forks. From the [docs](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-events-for-forked-repositories): >When you create a pull request from a forked repository to the base repository, GitHub sends...

>Yes our process is all centered around forks (fairly common open source model). Yes, that's why I think it makes sense to support this case correctly. I'm not entirely sure...

Yes, that should work, see some comment above >Merging should work correctly, as the pull_request event is sent to the base repository (which has the correct permissions to do the...

> I would suppose this trust implication (label from maintainers -> safe to run workflows with secrets and/or merge) needs to be special cased in Github Yes, it's nice that...

I'm a bit confused here. The error says >error Couldn't publish package: "https://npm.pkg.github.com/@bonustrack%2flock" So do you want to publish it to GH packages (npm.pkg.github.com) or to NPM (npmjs.com)?

The error output you've shown is for publishing to GH (URL is npm.pkg.github.com). If you're having problems with publishing to NPM, you need to post that output.

I'm thinking: should we maybe add another option for this? Like TAG_PATTERN or so?