Mitigate pull_request_target alert for template validation

.github/actions/validate-template/action.yml

@@ -28,5 +28,11 @@ runs:
 
     - name: Validate template
       id: validate-template
-      run: echo "::set-output name=result::$(deno run --allow-read ${{ github.action_path }}/src/main.ts ${{ inputs.path }} ${{ inputs.directory }})"
+      env:
+        ACTION_PATH: ${{ github.action_path }}
+        PROJECT_ROOT: ${{ inputs.path }}
+        TEMPLATE_DIRECTORY: ${{ inputs.directory || 'templates' }}
+      run: |
+        result=$(deno run --allow-read "$ACTION_PATH/src/main.ts" "$PROJECT_ROOT" "$TEMPLATE_DIRECTORY")
+        printf 'result=%s\n' "$result" >> "$GITHUB_OUTPUT"
       shell: bash

.github/workflows/validate-template.yml

@@ -1,27 +1,42 @@
 name: Template Validation
 on:
-  pull_request_target:
+  pull_request:
     branches:
       - main
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
+          persist-credentials: false
 
       - name: Validate template
         id: validate-template
         uses: ./.github/actions/validate-template
         with:
-          path: $GITHUB_WORKSPACE
+          path: ${{ github.workspace }}
 
-      - name: Create comment
-        if: ${{ steps.validate-template.outputs.status != 0 && !github.event.pull_request.head.repo.fork }}
-        uses: peter-evans/create-or-update-comment@a35cf36e5301d70b76f316e867e7788a55a31dae # v1.4.5
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          body: ${{ steps.validate-template.outputs.detail }}
+      - name: Report validation result
+        env:
+          VALIDATION_STATUS: ${{ steps.validate-template.outputs.status }}
+          VALIDATION_DETAIL: ${{ steps.validate-template.outputs.detail }}
+        shell: bash
+        run: |
+          printf '## Template validation\n\n' >> "$GITHUB_STEP_SUMMARY"
+          if [ "$VALIDATION_STATUS" = "0" ]; then
+            printf 'All templates passed validation.\n' >> "$GITHUB_STEP_SUMMARY"
+          elif [ "$VALIDATION_STATUS" = "1" ]; then
+            printf '%s\n' "$VALIDATION_DETAIL" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::error::Template validator returned an unexpected status."
+            exit 1
+          fi

CONTRIBUTING.md

@@ -7,6 +7,9 @@ All users must sign the [Microsoft Contributor License Agreement (CLA)](https://
 
 For Microsoft employees, make sure that your GitHub account is part of the Azure organization. [Use this page](http://aka.ms/azuregithub) to link your account.
 
+### Template validation
+Pull requests targeting `main`, including pull requests from forks, run the Template Validation workflow against the PR's base commit on `main`, not the proposed PR changes, preserving the original validation scope. The workflow uses a read-only token, does not persist checkout credentials, and reports validation details in the Actions run summary instead of posting PR comments. Validation errors and warnings do not fail the check; workflow execution failures still do. Manual runs remain available through `workflow_dispatch` and validate the selected ref.
+
 ### Code of Conduct
 This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).