name: PR CI Security Gate

on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  actions: write
  contents: read
  pull-requests: write

jobs:
  security-gate:
    # Members/collaborators/owners trigger PR CI directly — gate only needed for forks
    if: "!contains(fromJSON('[\"MEMBER\",\"OWNER\",\"COLLABORATOR\"]'), github.event.pull_request.author_association)"
    # Intentionally not passing `secrets: inherit` to avoid leaking secrets in runs triggered from forked repos
    uses: huggingface/transformers-ci/.github/workflows/pr-ci-security-gate.yml@main