CI: pull requests build on pull_request_target (a conflicting one never fires pull_request); README: contributors and a ledger of their pull requests kept by a workflow

.github/scripts/contributions.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Regenerates the contributions table in README.md, between its markers, from the repository's
+# pull requests: one row per pull request by anyone but the owner, and a line of totals per
+# contributor. Run by the Contributions ledger workflow when a pull request is opened, merged or
+# closed, and by hand with: gh auth status && .github/scripts/contributions.sh OWNER/REPO
+set -euo pipefail
+REPO=${1:-The412Banner/SteamDeck}
+OWNER=${REPO%%/*}
+ROWS=$(gh api "repos/$REPO/pulls?state=all&per_page=100" --paginate \
+  --jq '.[] | select(.user.login != "'"$OWNER"'")
+        | [.user.login, .number, (.title | gsub("\\|"; "\\\\|")), (.created_at[0:10]),
+           (if .merged_at then "merged " + .merged_at[0:10] elif .state == "closed" then "closed" elif .draft then "draft" else "open" end),
+           .html_url] | @tsv' | sort -t"$(printf '\t')" -k1,1 -k2,2n)
+{
+  echo "<!-- contributions:start -->"
+  echo "_From the repository's pull requests; rewritten when one is opened, merged or closed._"
+  echo
+  echo "| Contributor | Pull request | Opened | State |"
+  echo "|---|---|---|---|"
+  if [ -z "$ROWS" ]; then
+    echo "| — | none yet | | |"
+  else
+    while IFS=$'\t' read -r login num title opened state url; do
+      echo "| [@$login](https://github.com/$login) | [#$num]($url) $title | $opened | $state |"
+    done <<< "$ROWS"
+    echo
+    printf '%s\n' "$ROWS" | awk -F'\t' 'NF { t[$1]++; if ($5 ~ /^merged/) m[$1]++ } END { for (l in t) printf("- **@%s**: %d submitted, %d merged\n", l, t[l], m[l] + 0) }' | sort
+  fi
+  echo "<!-- contributions:end -->"
+} > /tmp/contributions.md
+python3 - <<'PY'
+import re
+s = open('README.md').read()
+new = open('/tmp/contributions.md').read().rstrip('\n')
+out, n = re.subn(r'<!-- contributions:start -->.*?<!-- contributions:end -->', lambda m: new, s, flags=re.S)
+if n != 1:
+    raise SystemExit("README.md has no contributions markers")
+open('README.md', 'w').write(out)
+PY
+echo "README.md: contributions table rewritten"

.github/workflows/build.yml

@@ -21,8 +21,10 @@ on:
   # A pull request against main builds by itself: the contributor's branch, as it would be once
   # merged onto main, comes back as an apk on the run without anyone here pressing a button.
   # Every push to the pull request rebuilds it and cancels the build it replaces; a draft waits
-  # until it is marked ready. Same as Bannerlator's PR check.
-  pull_request:
+  # until it is marked ready. pull_request_target rather than pull_request: GitHub does not run
+  # the latter at all while a pull request conflicts with main, and saying what conflicts is the
+  # point. The workflow file is always main's; the pull request's own code is checked out below.
+  pull_request_target:
     branches: [ main ]
     types: [ opened, synchronize, reopened, ready_for_review ]
     paths-ignore:
@@ -38,7 +40,7 @@ permissions:
 
 # A newer push makes the running build pointless; stop paying for it.
 concurrency:
-  group: build-${{ github.ref }}
+  group: build-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
@@ -47,7 +49,7 @@ env:
 
 jobs:
   build:
-    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    if: ${{ github.event_name != 'pull_request_target' || !github.event.pull_request.draft }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -56,14 +58,14 @@ jobs:
       # the next step is to say so and show where.
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: ${{ github.event_name == 'pull_request' && 0 || 1 }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: ${{ github.event_name == 'pull_request_target' && 0 || 1 }}
 
       # The pull request as it would be once merged onto main is what gets built. When it cannot
       # be merged, the conflicting files and the conflicting hunks go into the run summary and the
       # pull-request comment, and the job stops here: there is nothing coherent to build.
       - name: Merge onto main, or say what conflicts
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request_target'
         run: |
           set -uo pipefail
           git config user.name "ci"
@@ -295,7 +297,7 @@ jobs:
       # build failed, the compiler's own errors with paths made short. Fork pull requests carry a
       # read-only token and cannot comment; the same text is in the run summary either way.
       - name: Report on the pull request
-        if: always() && github.event_name == 'pull_request'
+        if: always() && github.event_name == 'pull_request_target'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/contributions.yml

@@ -0,0 +1,40 @@
+name: Contributions ledger
+
+# Keeps the Contributors section of the README current: every pull request by a contributor,
+# with its state, and a line of totals each. Runs when a pull request is opened, merged or
+# closed and commits the README to main as the Actions bot. The README is documentation, so
+# that commit does not buy an apk build.
+on:
+  pull_request_target:
+    types: [ opened, reopened, closed, edited ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: read
+
+concurrency:
+  group: contributions
+  cancel-in-progress: false
+
+jobs:
+  ledger:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+      - name: Rewrite the table
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: .github/scripts/contributions.sh "$GITHUB_REPOSITORY"
+      - name: Commit it when it changed
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add README.md
+          if git diff --cached --quiet; then echo "ledger unchanged"; exit 0; fi
+          git commit -m "README: contributions ledger"
+          git push origin HEAD:main

README.md

@@ -13,6 +13,24 @@ Around that: the Vulkan driver each half of the session draws with is yours to i
 audio can bypass PulseAudio and carry a microphone, the cores the client and a game get are
 separate, and every session writes a folder of logs meant to be attached to a report as it is.
 
+## Contributors
+
+Building this alongside the owner. A pull request from either of them builds by itself and gets
+a comment saying whether it merges, what conflicts, or what failed to compile.
+
+- **MaxsTechReview** — [@maxjivi05](https://github.com/maxjivi05)
+- **Kurt Himebauch** — [@xXJSONDeruloXx](https://github.com/xXJSONDeruloXx)
+
+<!-- contributions:start -->
+_From the repository's pull requests; rewritten when one is opened, merged or closed._
+
+| Contributor | Pull request | Opened | State |
+|---|---|---|---|
+| [@xXJSONDeruloXx](https://github.com/xXJSONDeruloXx) | [#1](https://github.com/The412Banner/SteamDeck/pull/1) initial decky installer stuff | 2026-09-23 | draft |
+
+- **@xXJSONDeruloXx**: 1 submitted, 0 merged
+<!-- contributions:end -->
+
 ## Requirements
 
 - An **arm64 Android device with an Adreno GPU that Turnip supports** — in practice Adreno **730 or