[BillWagner]

Update the targets and permissions for github workflows

• Use pull-request instead of pull-request-target
• Apply necessary job permissions for checks and statuses (and occasionally pull-requests)

[Copilot]

🟢 Approval recommended

The status checker supports the new trigger, and no blocking issues were identified in the permission changes.

No open issues 🎉

What changed in this PR

Updates GitHub Actions triggers and job permissions for documentation build checks and reporting.

Changes:

• Switches the OPS status checker from pull_request_target to pull_request.
• Adds check-write access and expands status permissions for relevant jobs.

File	Description
.github/​workflows/​snippets5000.yml	Adds checks: write.
.github/​workflows/​ops-build-reporter.yml	Changes status access from read to write.
.github/​workflows/​check-for-build-warnings.yml	Changes the PR trigger and grants check/status write access.

_{Review effort: Balanced}

[gewarren]

This is okay? Not sure why you're adding add'l perms here since it's already working.

[BillWagner]

Good catch. I thought I'd removed that.

[gewarren]

Why is this needed if it's working as-is?

[BillWagner]

This is because when it moves from pull-request-target to pull-request, it needs this permission to write a check run result. This enables the snippets 5000 to write checks (as markdownlint does) when the PR is from a fork.

[gewarren]

It's already using pull_request though...