ci: harden verify workflow against pull_request_target secret exfiltration

.github/workflows/verify-pr-code.yml

@@ -0,0 +1,104 @@
+name: verify-pr-code
+
+on:
+  pull_request:
+    types: [ opened, edited, synchronize, reopened, ready_for_review ]
+
+permissions:
+  contents: read
+
+jobs:
+  standards:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/setup-go
+
+      - name: Verify Docs
+        if: always()
+        run: |
+          set -e
+          echo "Verifying documentation..."
+          make docs 1>/dev/null
+          DOCS_CHANGES=$(git status --porcelain)
+
+          if [ -n "$DOCS_CHANGES" ]; then
+            cat >> "${REASON_FILE}" << EOF
+          * ❌ Documentation is out of date:
+            \`\`\`bash
+          $(echo -e "$DOCS_CHANGES" | sed 's/^/  /')
+            \`\`\`
+            Please run \`make docs\` and commit the changes.
+          EOF
+            exit 1
+          fi
+        env:
+          REASON_FILE: ${{ runner.temp }}/failed_reason.txt
+        shell: bash
+
+      - name: Verify Code Standards
+        if: always()
+        run: |
+          set +e
+          echo "Verifying code standard output usage..."
+          CODE_STD_OUT_USAGE=$(grep -r -E 'fmt\.Print|os\.Stdout|os\.Stderr' --exclude-dir=out ./internal)
+
+          if [ -n "$CODE_STD_OUT_USAGE" ]; then
+            cat >> "${REASON_FILE}" << EOF
+          * ❌  Found usage of \`os.Stdout\`, \`os.Stderr\` or \`fmt.Print\` in code:
+            \`\`\`bash
+          $(echo -e "$CODE_STD_OUT_USAGE" | sed 's/^/  /')
+            \`\`\`
+            Please use the \`internal/out\` package for output handling instead.
+          EOF
+            exit 1
+          fi
+        env:
+          REASON_FILE: ${{ runner.temp }}/failed_reason.txt
+        shell: bash
+
+      - name: Prepare comment artifact
+        if: always()
+        run: |
+          set +e
+          FAIL_REASON=$(cat "${REASON_FILE}" 2>/dev/null || echo "")
+
+          if [ -n "$FAIL_REASON" ]; then
+            echo "Standards violation detected"
+            cat > "${ARTIFACT_DIR}/comment-body.md" << EOF
+          # ⚠️ Proposed changes verification failed
+
+          This message means some of your changes may interrupt repository standards.
+
+          Follow these requirements:
+
+          ${FAIL_REASON}
+
+          Find more detailed information in the \`verify-pr-code / standards\` action.
+          EOF
+          else
+            echo "No standards violation detected"
+            cat > "${ARTIFACT_DIR}/comment-body.md" << 'EOF'
+          # ✅ Proposed changes verification passed
+
+          This pull request comes with up-to-date documentation and no illegal standard output usages.
+
+          Find more detailed information in the `verify-pr-code / standards` action.
+          EOF
+          fi
+
+          echo "${{ github.event.pull_request.number }}" > "${ARTIFACT_DIR}/pr_number.txt"
+        env:
+          REASON_FILE: ${{ runner.temp }}/failed_reason.txt
+          ARTIFACT_DIR: ${{ runner.temp }}
+        shell: bash
+
+      - name: Upload artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: standards-check-result
+          path: |
+            ${{ runner.temp }}/comment-body.md
+            ${{ runner.temp }}/pr_number.txt

.github/workflows/verify-pr-comment.yml

@@ -0,0 +1,60 @@
+name: verify-pr-comment
+
+on:
+  workflow_run:
+    workflows: ["verify-pr-code"]
+    types: [completed]
+
+permissions: {}
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download artifact
+        id: download
+        uses: actions/download-artifact@v4
+        with:
+          name: standards-check-result
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        continue-on-error: true
+
+      - name: Check artifact downloaded
+        if: steps.download.outcome == 'failure'
+        run: |
+          echo "Artifact not found — workflow may have been cancelled. Skipping comment."
+        shell: bash
+
+      - name: Read PR number
+        if: steps.download.outcome == 'success'
+        id: pr
+        run: |
+          PR_NUMBER=$(cat pr_number.txt 2>/dev/null | tr -d '[:space:]')
+          if [ -z "$PR_NUMBER" ]; then
+            echo "pr_number.txt is empty or missing"
+            exit 1
+          fi
+          echo "number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+        shell: bash
+
+      - name: Post or edit PR comment
+        if: steps.download.outcome == 'success' && steps.pr.outcome == 'success'
+        run: |
+          FLAGS="--body-file comment-body.md"
+
+          LAST_COMMENT_ID=$(gh pr view "${{ steps.pr.outputs.number }}" -R kyma-project/cli --json "comments" \
+            | jq --raw-output '.comments[] | select(.author.login=="github-actions[bot]") | .databaseId' \
+            | tail -1)
+
+          if [ -n "$LAST_COMMENT_ID" ]; then
+            echo "Editing last comment with ID: ${LAST_COMMENT_ID}"
+            FLAGS="${FLAGS} --edit-last"
+          fi
+
+          gh pr comment "${{ steps.pr.outputs.number }}" -R kyma-project/cli $FLAGS
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash