🌱 Remove "pull_request_target" from Github Workflows. (#1556)

Author: guettli

.github/workflows/pr-e2e.yaml

@@ -1,6 +1,6 @@
 name: E2E PR Blocking
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
     branches:
       - main
@@ -16,13 +16,12 @@ env:
 jobs:
   manager-image:
     name: Build and push manager image
-    if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Build and push manager image
@@ -31,20 +30,18 @@ jobs:
 
   test-release:
     name: Test Release
-    if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
       - name: Test Release
         id: manager-image
         uses: ./.github/actions/test-release
 
   e2e-hcloud-basic:
     name: Test Hcloud Basic
-    if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     concurrency: ci-${{ github.ref }}-e2e-basic
     runs-on: ubuntu-latest
     permissions:
@@ -56,8 +53,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
       - name: Run e2e Test
         id: e2e
         uses: ./.github/actions/e2e
@@ -68,7 +63,7 @@ jobs:
 
   e2e-hetzner-basic:
     name: Test Hetzner Baremetal Basic
-    if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     concurrency: ci-${{ github.ref }}-e2e-basic-hetzner
     runs-on: ubuntu-latest
     permissions:
@@ -80,8 +75,6 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
       - name: Run e2e Test
         id: e2e-bm
         uses: ./.github/actions/e2e

.github/workflows/pr-lint.yml

@@ -1,7 +1,7 @@
 name: "Lint Pull Request"
 on: # yamllint disable-line rule:truthy
   workflow_dispatch:
-  pull_request_target:
+  pull_request:
     types: [opened, edited, synchronize, reopened, ready_for_review]
     paths:
       - "**.go"
@@ -30,7 +30,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
       - name: Fixup git permissions

.github/workflows/pr-verify.yml

@@ -1,6 +1,6 @@
 name: Verify Pull Request
 on: # yamllint disable-line rule:truthy
-  pull_request_target:
+  pull_request:
     types: [opened, edited, synchronize, reopened, ready_for_review]
 # yamllint disable rule:line-length
 jobs:
@@ -16,8 +16,6 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Verify Boilerplate
         run: make verify-boilerplate