Allow testing external contributions using secrets (#667)

.github/workflows/tests.yml

@@ -3,7 +3,7 @@ name: Tests
 on:
   push:
     branches: [main]
-  pull_request:
+  pull_request_target:
   workflow_dispatch:
 
 env:
@@ -14,13 +14,22 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  authorize:
+    environment: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
+
   lint:
+    needs: authorize
+
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set up Python 3.9
         uses: actions/setup-python@v5
@@ -53,6 +62,8 @@ jobs:
         run: nox -s lint
 
   datachain:
+    needs: authorize
+
     timeout-minutes: 40
     runs-on: ${{ matrix.os }}
     strategy:
@@ -75,6 +86,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set up Python ${{ matrix.pyv }}
         uses: actions/setup-python@v5
@@ -117,6 +129,8 @@ jobs:
         run: nox -s docs
 
   examples:
+    needs: authorize
+
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     strategy:
@@ -132,9 +146,10 @@ jobs:
           - {os: ubuntu-latest-4-cores, pyv: "3.9", group: multimodal}
           - {os: ubuntu-latest-4-cores, pyv: "3.12", group: multimodal}
 
-
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
       - name: Set up Python ${{ matrix.pyv }}
         uses: actions/setup-python@v5