Try setting only pull_request_target trigger

Author: charlesbluca

.github/workflows/ci-pull-request.yml

@@ -1,15 +1,15 @@
 name: Pull Request Validation
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
       - reopened
       - labeled
 
 concurrency:
-  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
+  group: ${{ github.workflow }}-pr-${{ github.event.pull_request_target.number }}
   cancel-in-progress: true
 
 jobs:
@@ -32,7 +32,7 @@ jobs:
     with:
       platform: 'linux/amd64'
       target: 'test'
-      tags: 'nv-ingest:pr-${{ github.event.pull_request.number }}'
+      tags: 'nv-ingest:pr-${{ github.event.pull_request_target.number }}'
       base-image: 'ubuntu'
       base-image-tag: 'jammy-20250415.1'
       test-selection: 'full'
@@ -45,6 +45,7 @@ jobs:
   # Library mode integration tests (requires approval for external contributors)
   library-mode-check-access:
     name: Check Library Mode Test Access
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     outputs:
       has-access: ${{ steps.check.outputs.has-access }}
@@ -53,23 +54,25 @@ jobs:
         id: check
         run: |
           HAS_ACCESS="false"
-          if [[ "${{ github.event.pull_request.author_association }}" == "MEMBER" ]] || \
-             [[ "${{ github.event.pull_request.author_association }}" == "COLLABORATOR" ]] || \
-             [[ "${{ github.event.pull_request.author_association }}" == "OWNER" ]] || \
-             [[ "${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}" == "true" ]]; then
+          if [[ "${{ github.event.pull_request_target.author_association }}" == "MEMBER" ]] || \
+             [[ "${{ github.event.pull_request_target.author_association }}" == "COLLABORATOR" ]] || \
+             [[ "${{ github.event.pull_request_target.author_association }}" == "OWNER" ]] || \
+             [[ "${{ contains(github.event.pull_request_target.labels.*.name, 'ok-to-test') }}" == "true" ]]; then
             HAS_ACCESS="true"
           fi
           echo "has-access=$HAS_ACCESS" >> $GITHUB_OUTPUT
 
   library-mode-test:
     name: Test Library Mode
     needs: library-mode-check-access
-    if: needs.library-mode-check-access.outputs.has-access == 'true'
+    if: |
+      github.event_name == 'pull_request_target' &&
+      needs.library-mode-check-access.outputs.has-access == 'true'
     uses: ./.github/workflows/reusable-integration-test.yml
     with:
       runner: 'ubuntu-latest'
       timeout-minutes: 60
-      source-ref: ${{ github.event.pull_request.head.sha }}
+      source-ref: ${{ github.event.pull_request_target.head.sha }}
     secrets:
       AUDIO_FUNCTION_ID: ${{ secrets.AUDIO_FUNCTION_ID }}
       EMBEDDING_NIM_MODEL_NAME: ${{ secrets.EMBEDDING_NIM_MODEL_NAME }}