From 16d6028588ca2aca8c343be8f59282b8f619e91c Mon Sep 17 00:00:00 2001
From: Genevieve Warren <24882762+gewarren@users.noreply.github.com>
Date: Wed, 29 Jul 2026 10:32:32 -0700
Subject: [PATCH 1/2] Update status check workflow and add preview link
 workflow

---
 .../workflows/check-for-build-warnings.yml    | 28 +++++++++++--------
 .github/workflows/generate-preview-links.yml  | 25 +++++++++++++++++
 2 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 .github/workflows/generate-preview-links.yml

diff --git a/.github/workflows/check-for-build-warnings.yml b/.github/workflows/check-for-build-warnings.yml
index a8ed666c7b47..a09c7b019a22 100644
--- a/.github/workflows/check-for-build-warnings.yml
+++ b/.github/workflows/check-for-build-warnings.yml
@@ -1,21 +1,25 @@
-name: 'Status checker'
+name: 'OPS status checker'
 
-on: 
-  pull_request_target:
+on:
+  pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   status_checker_job:
     name: Look for build warnings
     runs-on: ubuntu-latest
     permissions:
-        statuses: write
-        issues: write
-        pull-requests: write
+      statuses: read
+      pull-requests: write
     steps:
-    - uses: actions/checkout@v3
-    - uses: dotnet/docs-actions/actions/status-checker@main
-      with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        docs_path: "aspnetcore"
-        url_base_path: "aspnet/core"
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: dotnet/docs-tools/actions/status-checker@455480c2e1c2fa90ecb711963250f000d66d3251 # main
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/generate-preview-links.yml b/.github/workflows/generate-preview-links.yml
new file mode 100644
index 000000000000..84f913856bd4
--- /dev/null
+++ b/.github/workflows/generate-preview-links.yml
@@ -0,0 +1,25 @@
+name: 'Preview link generator'
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  preview_link_generator_job:
+    name: Generate preview link table
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: read
+      pull-requests: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: dotnet/docs-tools/actions/preview-link-generator@455480c2e1c2fa90ecb711963250f000d66d3251 # main
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}

From 19375f74ec6eb4e11194c368fdff3aa6b69a233a Mon Sep 17 00:00:00 2001
From: Genevieve Warren <24882762+gewarren@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:15:32 -0700
Subject: [PATCH 2/2] Apply suggestion from @gewarren

---
 .github/workflows/check-for-build-warnings.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-for-build-warnings.yml b/.github/workflows/check-for-build-warnings.yml
index a09c7b019a22..ef30a22af709 100644
--- a/.github/workflows/check-for-build-warnings.yml
+++ b/.github/workflows/check-for-build-warnings.yml
@@ -1,7 +1,7 @@
 name: 'OPS status checker'
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, reopened]
 
 permissions: