Revert pull_request_target (#225)

`pull_request_target` has not been the drop-in replacement it promises
to be. Revert its addition and disable build jobs for external PRs.

---------

Co-authored-by: Copilot <[email protected]>
Signed-off-by: dalthecow <[email protected]>

Author: 2 people

.github/workflows/development.yml

@@ -12,8 +12,6 @@ jobs:
         python: ["3.9", "3.13"]
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -30,8 +28,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -51,8 +47,6 @@ jobs:
         python: ["3.9", "3.13"]
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -69,8 +63,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -90,8 +82,6 @@ jobs:
         python: ["3.9"]
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -108,8 +98,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -129,8 +117,6 @@ jobs:
         python: ["3.9", "3.13"]
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -147,8 +133,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -168,8 +152,6 @@ jobs:
         python: ["3.9", "3.13"]
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -186,8 +168,6 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@v4
-        with:
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v4
@@ -201,6 +181,8 @@ jobs:
         run: npm run test:integration
 
   build:
+    # Only build if the PR branch is local
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -210,7 +192,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: "${{ github.event.pull_request.merge_commit_sha }}"
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -357,6 +338,8 @@ jobs:
         run: echo "Skipping UI preview build - no relevant files changed"
 
   build-and-push-container:
+    # Only build if the PR branch is local
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       packages: write