Ability to run tests from external PRs (#313)

* test

* checkout on the merge commit

* fix

.github/workflows/fast_tests.yml

@@ -1,8 +1,11 @@
 name: Unit and integration tests
 
+
+# WARNING: As this workflow supports the pull_request_target event, please exercise extra care when editing it.
+# Reference: https://gist.github.com/fxmarty/fba1ea3b2ebbf9a75cca71c08f05a85b
 on:
   workflow_dispatch:
-  pull_request:
+  pull_request_target:
     branches: [ main ]
     paths:
       - "optimum/**.py"
@@ -14,8 +17,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  authorize:
+    environment:
+      ${{ github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      'external' || 'internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
+
   start-runner:
     name: Start self-hosted EC2 runner
+    needs: authorize
     runs-on: ubuntu-20.04
     env:
       AWS_REGION: us-east-1
@@ -50,13 +63,28 @@ jobs:
             ]
   transformers:
     name: Run tests for optimum.habana.transformers
-    needs: start-runner # required to start the main job when the runner is ready
+    needs:
+      - authorize
+      - start-runner # required to start the main job when the runner is ready
     runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
     env:
       AWS_REGION: us-east-1
     steps:
-      - name: Checkout
+      - name: Checkout on branch
+        if: github.event_name != 'pull_request_target'
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.ref }}
+      - name: Checkout on PR merge commit
+        if: github.event_name == 'pull_request_target'
         uses: actions/checkout@v2
+        with:
+          ref: "refs/pull/${{ github.event.number }}/merge"
+          fetch-depth: 2
+      - name: Security - check PR SHA
+        if: github.event_name == 'pull_request_target'
+        run: |
+            [[ "$(git rev-parse 'HEAD^2')" == "${{ github.event.pull_request.head.sha }}" ]]
       - name: Pull image
         run: |
             docker pull vault.habana.ai/gaudi-docker/1.10.0/ubuntu20.04/habanalabs/pytorch-installer-2.0.1:latest
@@ -76,14 +104,28 @@ jobs:
   diffusers:
     name: Run tests for optimum.habana.diffusers
     needs:
+      - authorize
       - start-runner # required to get output from the start-runner job
       - transformers # required to wait for the previous tests to finish
     runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
     env:
       AWS_REGION: us-east-1
     steps:
-      - name: Checkout
+      - name: Checkout on branch
+        if: github.event_name != 'pull_request_target'
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.ref }}
+      - name: Checkout on PR merge commit
+        if: github.event_name == 'pull_request_target'
         uses: actions/checkout@v2
+        with:
+          ref: "refs/pull/${{ github.event.number }}/merge"
+          fetch-depth: 2
+      - name: Security - check PR SHA
+        if: github.event_name == 'pull_request_target'
+        run: |
+            [[ "$(git rev-parse 'HEAD^2')" == "${{ github.event.pull_request.head.sha }}" ]]
       - name: Pull image
         run: |
             docker pull vault.habana.ai/gaudi-docker/1.10.0/ubuntu20.04/habanalabs/pytorch-installer-2.0.1:latest
@@ -103,6 +145,7 @@ jobs:
   stop-runner:
     name: Stop self-hosted EC2 runner
     needs:
+      - authorize
       - start-runner # required to get output from the start-runner job
       - transformers # required to wait for the tests to be finished
       - diffusers # required to wait for the tests to be finished