Set CI Tests workflow to run under pr-tests github environment

[weiji14]

Description of proposed changes

Enable forked repositories to access DagsHub token, by granting them access within a GitHub environment

Done using the following steps:

1. Go to https://github.com/GenericMappingTools/pygmt/settings/environments, create 'New environment' called pr-tests
2. Inside 'Configure pr-tests', click on 'Add environment secret' and add DAGSHUB_TOKEN with token from https://dagshub.com/docs/api/#access-token
3. (Optional) configure protection rules

Reference:

• https://2i2c.org/blog/2025/github-action-secrets-forked-repositories/
• https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#controlling-changes-from-forks-to-workflows-in-public-repositories
• https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments
• https://github.com/orgs/community/discussions/50161

Fixes #4147

Preview:

Reminders

• Run make format and make check to make sure the code follows the style guide.
• Add tests for new features or tests that would have caught the bug that you're fixing.
• Add new public functions/methods/classes to doc/api/index.rst.
• Write detailed docstrings for all functions/methods.
• If wrapping a new module, open a 'Wrap new GMT module' issue and submit reasonably-sized PRs.
• If adding new functionality, add an example to docstrings or tutorials.

Slash Commands

You can write slash commands (/command) in the first line of a comment to perform
specific operations. Supported slash command is:

• /format: automatically format and lint the code

[weiji14]

Wow, these github environment deployments are super noisy (9 messages for 9 matrix builds?!!), seems like a known issue at https://github.com/orgs/community/discussions/14417.

Also not 100% sure if it works yet, need to test on a PR from a fork.

[seisman]

Yes, super noisy, do you want to approve this PR so that you can test from a fork?

[seisman]

Actually I'm wondering if we could create a resuable workflow (xref: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows) that runs the dvc pull commmand, stores the .dvc/cache directory as a cache or artifact, and then other workflows can download the artifact from GitHub, rather than from DagsHub.

[weiji14]

Yes, super noisy, do you want to approve this PR so that you can test from a fork?

Yeah, I think so. Can test it in #4135 perhaps.

I did think about using the cache action, but that seemed like more work, but probably better as a longer term solution?

[weiji14]

Hmm, merged this PR, and updated things at #4135 but it doesn't seem to be picking up the token (see CI runs at commit 5078cb4). I'm wondering if it's because we have two token secrets with the same name.

I'll revert this PR first until we can figure out another solution.