ci: Ensure tj-actions/changed-files works with pull_request_target (#366)

Co-authored-by: Raphaël Droz <raphael.droz+floss@gmail.com>

Author: Raphaël Droz

.github/workflows/actions.yml

@@ -2,18 +2,32 @@ name: "CI"
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened]
   push:
     branches:
       - 'v3'
       - 'feature/*'
       - 'fix/*'
   workflow_dispatch:
 
+permissions:
+  actions: read
+  checks: write
+  contents: read
+  deployments: read
+  issues: read
+  packages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: write
+
 env:
   SAUCE_USERNAME: ${{secrets.SAUCE_USERNAME}}
   SAUCE_ACCESS_KEY: ${{secrets.SAUCE_ACCESS_KEY}}
   CC_TEST_REPORTER_ID: ${{secrets.CC_TEST_REPORTER_ID}}
   DISPLAY: ':99.0'
+
 jobs:
   approve:
     runs-on: ubuntu-latest
@@ -31,15 +45,19 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Is environment ok
         run: |
           echo $SAUCE_USERNAME
+          echo ${{ github.event.pull_request.base.sha }}  ${{ github.sha }} ${{ github.event.pull_request.head.sha }}
 
       - name: Get specific changed files
         id: source-changed
         uses: tj-actions/changed-files@v1.1.3
         with:
+          base_sha: ${{ github.sha }}
+          sha: ${{ github.event.pull_request.head.sha }}
           files: |
             src
             test