[llvm] Reapply [workflows] Split pr-code-format into two parts to make it more secure (#78215) (PR #80495)

[Aiden Grossman via llvm-commits]

boomanaiden154 wrote:

> Firstly -- a pull_request run is always run in the context of the "merge" branch, not the PR head. The "merge" branch is auto-updated (if there are no file conflicts) to the latest revision of the target branch. So, a PR will generally automatically see a new .github/workflow file after it's committed -- and by default, we'd get all the rest of the new files too!

Right, and it doesn't run if there are any merge conflicts (one reason why the current design is the way it is). My point was mainly about where the workflow definition is pulled from that gets run. For some reason I thought it might have been the fork branch, but that isn't the case (based on the documentation).

I agree that looking at the merge commit would make things a lot simpler. I think that's good to split out into a separate patch though so we can make sure that the current state in-tree is reliable after the split. That is another thing on my todo list.

https://github.com/llvm/llvm-project/pull/80495