Allow maintainer to re-run int. tests for fork PRs

.github/workflows/integration-test.yml

@@ -1,7 +1,11 @@
 name: Integration Tests
 
 on:
-  pull_request:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
   push:
     branches:
       - main
@@ -30,14 +34,38 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Fetch user permission
+        id: permission
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+      - name: Check user permission
+        if: steps.permission.outputs.require-result == 'false'
+        # If the triggering actor does not have write permission (i.e., this is a
+        # PR from a fork), then we exit, otherwise most of the integration tests will
+        # fail because they require access to secrets.  In this case, a maintainer
+        # will need to make sure the PR looks safe, and if so, manually re-run the
+        # failed jobs.
+        run: |
+          echo "User ${{ github.triggering_actor }} does not have permission to run integration tests."
+          echo "A maintainer must perform a security review and re-run this build, if the code is safe."
+          exit 1
+      - name: Checkout source
+        if: ${{ github.event_name == 'push' }}
+        uses: actions/checkout@v4
+      - name: Checkout source
+        if: ${{ github.event_name != 'push' }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full python version
         id: full-python-version
-        run: echo ::set-output name=version::$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))")
+        run: echo version=$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))") >> $GITHUB_OUTPUT
       - name: Install poetry
         uses: abatilo/actions-poetry@v3
       - name: Configure poetry