Why this PR that adds workflow does not trigger?

I create PR on my own fork first, it ran; then I create PR on the upstream fork, it doesn’t trigger. Bug?

The workflow doesn’t exist in upstream. And when it runs it’s looking at the upstream.

Otherwise it’d be trivial for attackers to attack upstream repositories but creating malicious pull requests with new workflows.

To test this, upstream should try it in their own distinct fork. And then when they’re happy they can merge. After that it’ll run going forward.