Fix Check Workflow Events CI job

[martin-gaievski]

Description

The Check Workflow Events CI job (.github/workflows/check-workflow-events.yml) currently fails on every PR, for two reasons that are independent of the PR under review:

1. pr_review.yml uses pull_request_target (the actual exit 1). The checker prints 'pr_review.yml' workflow file contains 'pull_request_target' event, please remove! and exits 1. This event is intentional and required — pr_review.yml runs the opensearch-build code-diff analyzer/reviewer, which needs the BEDROCK_ACCESS_ROLE secret and pull-requests: write permission to comment on PRs (including those from forks). That is exactly what pull_request_target is for. The workflow was onboarded in Onboard code diff analyzer/reviewer and issue dedupe workflows (neural-search) #1841 (after the checker was added in Add check workflow events related checks #1128) and was simply never added to the allowlist alongside backport.yml and copy-linked-issue-labels.yml.
   → Fix: add pr_review.yml to the checker's allowlist (do not remove the event, which would break the feature and its secret/permission model).

2. backwards_compatibility_tests_workflow.yml fails YAML parsing. The checker logs bad file 'backwards_compatibility_tests_workflow.yml': yaml: ... did not find expected key. A stray }}'" fragment (plus a blank line) was accidentally introduced by the version bump in Increment version to 3.8.0-SNAPSHOT #1896, right after the Restart-Upgrade job's test command. The parallel Rolling-Upgrade job has no such fragment.
   → Fix: remove the stray lines. The run block is otherwise unchanged.

Check List

• New functionality includes testing.
• New functionality has been documented.
• Commits are signed per the DCO using --signoff.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 8c63c96.

Path	Line	Severity	Description
.github/workflows/check-workflow-events.yml	20	medium	Adds 'pr_review.yml' to the allowlist that bypasses the pull_request_target event security check. The pull_request_target event runs with write permissions and full access to repository secrets even for fork PRs — a known GitHub Actions attack vector. The content of pr_review.yml is not shown in this diff, so it cannot be verified that it safely handles these elevated privileges. Maintainers should review pr_review.yml to confirm it does not checkout untrusted code or pass fork-controlled inputs to privileged steps.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 0 | Medium: 1 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 8c63c96)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Latest suggestions up to 8c63c96
Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Fix incorrect file glob pattern The glob pattern .ym is incorrect and will match any filename containing .ym (e.g., .yml, .yaml, or even foo.ymX) as an unanchored substring match. Use a proper pattern like .yml (and consider .yaml) to correctly enumerate workflow files. .github/workflows/check-workflow-events.yml [16] -for file_found in `ls | grep .ym`; do +for file_found in *.yml *.yaml; do Suggestion importance[1-10]: 4 __ Why: The suggestion correctly identifies that ls | grep .ym is an imprecise pattern, but the existing code is not modified in this PR hunk (it's an unchanged line), and the change is tangential to the PR's purpose. Still, it's a valid minor improvement.	Low

---

Previous suggestions

Suggestions up to commit 38b22fe

Category	Suggestion	Impact
General	Tighten file matching pattern The grep .ym pattern is overly permissive (the . matches any character and ym is unanchored), so it can match unintended files. Use a stricter pattern like grep '.ya?ml$' to match only actual YAML files. .github/workflows/check-workflow-events.yml [16] -for file_found in `ls | grep .ym`; do +for file_found in `ls | grep '\.ya\?ml$'`; do Suggestion importance[1-10]: 3 __ Why: The suggestion correctly identifies that grep .ym is overly permissive, but the change is outside the scope of this PR (which only modified the allowlist condition on line 20). It's a minor improvement to a pre-existing pattern.	Low

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.43%. Comparing base (89afaf1) to head (8c63c96).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #1901   +/-   ##
=========================================
  Coverage     83.43%   83.43%           
  Complexity     3898     3898           
=========================================
  Files           291      291           
  Lines         13844    13844           
  Branches       2304     2304           
=========================================
  Hits          11551    11551           
  Misses         1458     1458           
  Partials        835      835           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Persistent review updated to latest commit 8c63c96