chore(ci): switch PR workflow from pull_request to pull_request_target for secrets (#3242)

* Update PR workflow: modify .github/workflows/pr.yaml to pull_request_target in order to access secrets

* Update PR workflow: modify .github/workflows/pr.yaml to pull_request_target in order to access secrets

* Update .github/workflows/pr.yaml

Co-authored-by: Frank Kong <[email protected]>

* Update .github/workflows/pr.yaml

Co-authored-by: Frank Kong <[email protected]>

* Update .github/workflows/pr.yaml

Co-authored-by: Frank Kong <[email protected]>

---------

Co-authored-by: Frank Kong <[email protected]>

Author: subhashkhileri

.github/workflows/pr.yaml

@@ -15,7 +15,11 @@
 name: PR
 
 on:
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: 
+    - main
+    - release-1.[0-9]+
 
 env:
   TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
@@ -26,12 +30,29 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  authorize:
+    # The 'external' environment is configured with the maintainers team as required reviewers.
+    # All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks.
+    # see list of approvers in OWNERS file
+    environment:
+      ${{ github.event.pull_request.head.repo.full_name == github.repository && 'internal' || 'external' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if internal PR
+        id: check
+        run: |
+          if [[ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
+            echo "✓ Internal PR - will run with PR code"
+          else
+            echo "✓ External PR - will run with base branch code for security"
+          fi
   build:
     name: Build with Node.js ${{ matrix.node-version }}
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node-version: [22]
+    needs: authorize
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -74,6 +95,7 @@ jobs:
     strategy:
       matrix:
         node-version: [22]
+    needs: authorize
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4