Migrate close-on-PR workflow off pull_request_target

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mrecachinas

.github/workflows/close-invalid-pr-writer.yml

@@ -0,0 +1,51 @@
+name: Close invalid PR writer
+
+on:
+  workflow_run:
+    workflows: [Close issue/PR on adding invalid label]
+    types: [completed]
+
+permissions:
+  issues: read
+  pull-requests: write
+
+jobs:
+  close-invalid-pr:
+    if: >
+      github.repository == 'github/copilot-cli' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close invalid PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then
+            PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')"
+          fi
+
+          if [ -z "${PR_NUMBER:-}" ]; then
+            echo "Unable to identify a single open PR for workflow run; skipping."
+            exit 0
+          fi
+
+          pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)"
+          if [ "$pr_state" != "open" ]; then
+            echo "PR #$PR_NUMBER is $pr_state; skipping."
+            exit 0
+          fi
+
+          if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then
+            echo "PR #$PR_NUMBER does not currently have the invalid label; skipping."
+            exit 0
+          fi
+
+          gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed

.github/workflows/close-invalid.yml

@@ -1,36 +1,40 @@
 name: Close issue/PR on adding invalid label
 
-# **What it does**: This action closes issues that are labeled as invalid in the repo.
+# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo.
 
 on:
   issues:
     types: [labeled]
-  pull_request_target:
+  pull_request:
     types: [labeled]
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
-  close-on-adding-invalid-label:
-    if:
-      github.repository == 'github/copilot-cli' && github.event.label.name ==
-      'invalid'
+  close-issue-on-adding-invalid-label:
+    if: >
+      github.repository == 'github/copilot-cli' &&
+      github.event_name == 'issues' &&
+      github.event.label.name == 'invalid'
     runs-on: ubuntu-latest
-
+    permissions:
+      issues: write
     steps:
       - name: Close issue
-        if: ${{ github.event_name == 'issues' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          URL: ${{ github.event.issue.html_url }}
-        run: gh issue close $URL
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPOSITORY: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: gh api -X PATCH "repos/$GH_REPOSITORY/issues/$ISSUE_NUMBER" -f state=closed
 
-      - name: Close PR
-        if: ${{ github.event_name == 'pull_request_target' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          URL: ${{ github.event.pull_request.html_url }}
-        run: gh pr close $URL
+  signal-invalid-pr-label:
+    if: >
+      github.repository == 'github/copilot-cli' &&
+      github.event_name == 'pull_request' &&
+      github.event.label.name == 'invalid'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - name: Record invalid PR label signal
+        run: echo "Invalid label signal for PR #${{ github.event.pull_request.number }}"