Adding pull_request_target workflow for secure PR validation

.github/workflows/build-and-test.yml

@@ -1,7 +1,8 @@
 name: Build and Test
 
 on:
-  pull_request:
+  workflow_run:
+    workflows: ["Publish Extension", "Receive PR"]
     branches:
       - main
   workflow_dispatch:

.github/workflows/publish-extension.yml

@@ -44,7 +44,9 @@ jobs:
   publish-gh-release:
     needs: build-and-test
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+        contents: write
+
     env:
       EXTENSION_VERSION: ${{ needs.build-and-test.outputs.extVersion }}
       GH_TOKEN: ${{ github.token }}

.github/workflows/receive-pr.yml

@@ -0,0 +1,12 @@
+name: Receive PR
+
+on:
+  pull_request_target: 
+    branches:
+      - main
+    paths-ignore:
+    - '.github/**'
+
+jobs:
+    build-and-test:
+        uses: ./.github/workflows/build-and-test.yml