ci: Use pull_request as trigger for unit tests

[booxter]

Otherwise the tested fork with the PR on review is not validated in CI.

Signed-off-by: Ihar Hrachyshka [email protected]

[booxter]

@courtneypacheco @ktdreyer please confirm this is safe / correct.

[ktdreyer]

From reading https://stackoverflow.com/questions/74957218/what-is-the-difference-between-pull-request-and-pull-request-target-event-in-git , I don't think this is safe.

[ktdreyer]

I did more reading here: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

Now I have learned more about the differences here:

pull_request will run on the PR's code, and it will not have access to any the secrets in our repositories (so it won't be able to run AWS tests).

pull_request_target does have access to secrets, but we should not use it to run untrusted PR code.

[booxter]

@ktdreyer since I switched unit tests to use github runners, is it safe to switch unit tests job to pull_request? Will it give us proper validation for PRs under review? I've checked what we do in CLI repo and we use pull_request there too, so I assume it's safe?

[ktdreyer]

Yes, thanks for clarifying.

I see #475 cleans up the ec2 reference, and I understand this only uses GH's own runners now.

[JamesKunstle]

I was using 'pull_request_target' because I thought that was required for the EC2 runners, but since we're no longer using those runners for unit testing this totally makes sense to me.