Iand/recipe scanner updates

[iandouglas]

Pull Request Description

trying one more update for the PR process for the recipe scanner

[Copilot]

Pull Request Overview

This PR updates the GitHub Actions workflow configuration for recipe validation and security scanning, changing from pull_request to pull_request_target triggers and adding additional permissions and validations.

Key changes:

• Switch workflow triggers from pull_request to pull_request_target for both validation and security scanning workflows
• Add issues: write permission to both workflows
• Enhance git diff filtering to only check added/modified files
• Add secrets validation in the security scanner workflow

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/validate-recipe-pr.yml	Updates trigger to pull_request_target, adds issues permission, and improves git diff filtering
.github/workflows/recipe-security-scanner.yml	Updates trigger to pull_request_target, adds issues permission, and adds secrets validation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Using pull_request_target instead of pull_request can be a security risk as it runs with write permissions in the context of the target repository. This allows potentially malicious code from external contributors to access secrets and modify the repository. Consider using pull_request with explicit checkout of the PR branch if write permissions are needed, or ensure proper input validation and sandboxing.

Suggested change

	pull_request_target:
	pull_request:

[Copilot]

Using pull_request_target instead of pull_request poses a security risk, especially in a security scanning workflow that has access to secrets (OPENAI_API_KEY, TRAINING_DATA_*). This trigger runs with repository write permissions and access to secrets even for external contributors, potentially allowing malicious actors to exfiltrate secrets or modify the repository.

Suggested change

	pull_request_target:
	pull_request: