From b85105e3c57230d7696b638d036805412d9ac9c7 Mon Sep 17 00:00:00 2001
From: Alexander Dines <alex@runloop.ai>
Date: Thu, 8 Jan 2026 14:47:08 -0800
Subject: [PATCH] cp dines

---
 .github/workflows/ci.yml | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f488177..5a87902b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,14 +2,24 @@ name: CI
 
 on:
   pull_request:
+  pull_request_target:
+    # Run on release-please PRs (created by GITHUB_TOKEN which doesn't trigger regular pull_request)
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
 
 jobs:
   format:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -25,9 +35,16 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -43,9 +60,16 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -62,9 +86,16 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: build
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -89,7 +120,8 @@ jobs:
   ready-to-merge:
     runs-on: ubuntu-latest
     needs: [format, lint, build, test]
-    if: always()
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: always() && (github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch')
     steps:
       - name: Check all jobs passed
         run: |