Allow access to secrets for external contributors

.github/workflows/check-test-release.yml

@@ -1,16 +1,29 @@
 name: Check, test and release
 on:
   push:
-  pull_request:
+  pull_request_target:
   schedule:
   - cron: '0 7 * * 1'  # M H d m w (Mondays at 7:00)
 
 env:
   MLEM_TESTS: "true"
 
 jobs:
+  authorize:
+    if: |
+      startsWith(github.ref, 'refs/tags') ||
+      github.event_name == 'pull_request_target' ||
+      github.event_name == 'schedule' ||
+      github.repository_owner != 'iterative'
+    environment:
+      ${{ (github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository) &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+    - run: echo ✓
   check:
-    if: startsWith(github.ref, 'refs/tags') || github.event_name == 'pull_request' || github.event_name == 'schedule' || github.repository_owner != 'iterative'
+    needs: authorize
     name: Check
     runs-on: ubuntu-latest
     steps:
@@ -21,6 +34,7 @@ jobs:
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.ref }}
     - uses: actions/setup-python@v2
     - name: set PYSHA
       run: echo "PYSHA=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
@@ -31,7 +45,7 @@ jobs:
     - run: pip install -U pre-commit tox
     - run: SKIP=pylint pre-commit run -a --show-diff-on-failure
   test:
-    if: startsWith(github.ref, 'refs/tags') || github.event_name == 'pull_request' || github.event_name == 'schedule' || github.repository_owner != 'iterative'
+    needs: authorize
     name: Test ${{ matrix.os }} with py${{ matrix.python }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -47,6 +61,7 @@ jobs:
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.ref }}
     - uses: actions/setup-python@v2
       with:
         python-version: ${{ matrix.python }}
@@ -103,6 +118,7 @@ jobs:
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
+        ref: ${{ github.event.pull_request.head.sha || github.ref }}
     - uses: actions/setup-python@v2
     - id: dist
       uses: casperdcl/deploy-pypi@v2