chore: fix workflow (#1772)

.github/workflows/update-pr-metadata.yml

@@ -3,6 +3,9 @@ name: Update Metadata
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
+  # CAREFUL! https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
 
 concurrency: 
   group: update-metadata-${{ github.ref }}
@@ -12,10 +15,6 @@ jobs:
   update-metadata:
     runs-on: ubuntu-latest
 
-    permissions:
-      issues: write
-      pull-requests: write
-
     steps:
       - name: Add labels
         uses: silverhand-io/actions-add-labels-run-steps@v1.1.2
@@ -36,14 +35,11 @@ jobs:
   pr-size-diff:
     runs-on: ubuntu-latest
 
-    permissions:
-      issues: write
-      pull-requests: write
-
     steps:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Prepare
         run: |

.github/workflows/upload-annotations.yml

@@ -15,9 +15,8 @@ jobs:
     # avoid out of memory issue since macOS has bigger memory
     # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources
     runs-on: macos-latest
-
-    permissions:
-      checks: write
+    # fork repos need to opt out
+    if: github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
       - uses: actions/checkout@v3