Update .gitea/workflows/run-hcdc.yaml

Reviewed-by: Tino Schreiber <tino.schreiber@t-systems.com>
Co-authored-by: Sebastian Gode <sebastian.gode@telekom.de>
Co-committed-by: Sebastian Gode <sebastian.gode@telekom.de>

.gitea/workflows/run-hcdc.yaml

@@ -1,8 +1,12 @@
-name: Run HCDC
+name: Check for illegal characters
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, synchronize, edited]
+  
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
   run-hcdc:
@@ -19,6 +23,14 @@ jobs:
           persist-credentials: false
           token: ${{ gitea.token }}
 
+      - name: Create local branch for PR head (same repo)
+        if: ${{ gitea.event.pull_request.head.repo.full_name == gitea.repository }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git checkout -B "${{ gitea.event.pull_request.head.ref }}" --no-track
+          git branch --show-current
+
       - name: Checkout PR head (fork via PR ref)
         if: ${{ gitea.event.pull_request.head.repo.full_name != gitea.repository }}
         uses: https://github.com/actions/checkout@v4
@@ -29,6 +41,14 @@ jobs:
           persist-credentials: false
           token: ${{ gitea.token }}
 
+      - name: Create local branch for PR head (fork)
+        if: ${{ gitea.event.pull_request.head.repo.full_name != gitea.repository }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git checkout -B "${{ gitea.event.pull_request.head.ref }}" --no-track
+          git branch --show-current
+
       - name: Checkout base
         uses: https://github.com/actions/checkout@v4
         with:
@@ -39,7 +59,6 @@ jobs:
           persist-credentials: false
           token: ${{ gitea.token }}
 
-
       - name: Get OTC token
         id: otc
         uses: https://github.com/opentelekomcloud-infra/github-actions/.github/actions/get-otc-token@v1