[Wang Zhang (Miwa199739)]

Purpose

Address the announced execution restriction on pull_request_target for .github/workflows/validate-template.yml without changing the existing main-branch validation scope or making validation findings a new merge gate. No event-policy exception or repository policy change is requested.

Changes

• Replace pull_request_target with pull_request, retaining the main target filter and manual workflow_dispatch trigger.
• Explicitly check out github.event.pull_request.base.sha for PR runs, preserving validation of the base commit on main, not PR-provided code. Manual runs fall back to github.sha for the selected ref.
• Restrict the workflow token to contents: read and disable persisted checkout credentials. Existing third-party action SHA pins are retained; no secrets are referenced.
• Replace automatic PR comments with Actions run summaries, avoiding comment-write permissions.
• Keep validator findings (status 1, including warnings/errors) informational, matching the original workflow. Execution failures and unexpected output statuses still fail explicitly.
• Replace deprecated ::set-output with $GITHUB_OUTPUT, and pass quoted action arguments through environment variables so summary output works reliably without shell expression interpolation.
• Document the intended behavior in CONTRIBUTING.md.

Deliberate behavior differences and limits

• Findings are now in the run summary instead of automatic same-repository PR comments.
• Standard pull_request fork-approval and merge-conflict restrictions apply.
• Main-only validation is intentionally preserved; this change does not add validation of incoming PR template changes.
• The restriction is addressed by removing the flagged event trigger, not by claiming that the existing workflow was proven exploitable.

Self-review and validation

Reviewed the full diff and checked that no upstream changes affect the touched workflow/action/documentation. No additional issues were identified in this scoped review.

Passed local checks for trigger/checkout/permission invariants, action SHA pins, Bash syntax, success and informational-finding summaries, explicit invalid-status failures, literal multiline/metacharacter-containing details, quoted arguments, JSON output round-trips, validator command failure propagation, and git diff --check.

Deno was stubbed for the shell/output tests. The actual Deno validator, a hosted GitHub Actions run, repository Policy insights, and CodeQL were not run as part of this local review.