Yet another day where 'pull_request_target` is allowed to exist and cause tons of pain. They really ought to kill it off by now.