fix(internal): 💚 Use pull_request_target and manual checks of permissions to be able to access secrets for DB branching

Author: vdvman1

.github/workflows/turso_branching.yaml

@@ -1,7 +1,7 @@
 name: Automatically create and cleanup Turso DB branches for each PR
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - reopened
@@ -16,11 +16,27 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Get user permissions
+        id: permissions
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check user permissions
+        if: steps.permissions.outputs.require-result == 'false'
+        run: |
+          echo "${{ github.triggering_actor }} does not have permissions on this repo."
+          echo "A user with write permissions should very carefully check the diff of this PR and then re-run the workflow if it is safe"
+          exit 1
       - name: Get branch name
         id: branch_name
         uses: tj-actions/branch-names@v8
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # This is dangerous without the first access check
       - name: Generate branched DB ID
         id: branch_db_id
         uses: actions/github-script@v7
@@ -62,7 +78,6 @@ jobs:
             fi
           fi
 
-          echo $RESPONSE
           HOSTNAME=$(echo $RESPONSE | jq -r '.database.Hostname')
           if [ -z "$HOSTNAME" ]; then
             echo "Hostname not found in response"
@@ -72,6 +87,8 @@ jobs:
           echo "hostname=$HOSTNAME" >> $GITHUB_OUTPUT
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # This is dangerous without the first access check
       - name: Run migrations
         env:
           DATABASE_URL: "libsql://${{ steps.create_db_branch.hostname }}"
@@ -93,6 +110,8 @@ jobs:
       - name: Checkout
         if: github.event.pull_request.merged == true
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # This is dangerous without the first access check
       - name: Apply migrations to production
         if: github.event.pull_request.merged == true
         env: