new permission approach

Signed-off-by: Justin Florentine <[email protected]>

.github/workflows/acceptance-tests.yml

@@ -1,6 +1,8 @@
 name: acceptance-tests
 on:
-  pull_request:
+  pull_request_target:
+    branches:
+      - main
   pull_request_review:
     types: [submitted]
 
@@ -9,8 +11,17 @@ env:
   total-runners: 16
 
 jobs:
+  authorize:
+    environment:
+      ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
   shouldRun:
     name: checks to ensure we should run
+    needs: authorize
     # necessary because there is no single PR approved event, need to check all comments/approvals/denials
     runs-on: ubuntu-22.04
     outputs:
@@ -60,6 +71,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/[email protected]
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.ref }}
       - name: Set up Java
         uses: actions/[email protected]
         with: