From 2110540fc7b9ca31ff4f5633f9b2098d12d235d1 Mon Sep 17 00:00:00 2001
From: Leewzh <116988731+Leewzh@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:02:16 +0800
Subject: [PATCH 1/2] ci: run trusted fork PRs with repository configuration

---
 .github/workflows/rocshmem-ci.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/rocshmem-ci.yml b/.github/workflows/rocshmem-ci.yml
index 607e48a..e1f8996 100644
--- a/.github/workflows/rocshmem-ci.yml
+++ b/.github/workflows/rocshmem-ci.yml
@@ -1,7 +1,7 @@
 name: rocSHMEM CI
 
 on:
-  pull_request:
+  pull_request_target:
     branches: [develop]
     types: [opened, synchronize, reopened, ready_for_review]
   schedule:
@@ -23,11 +23,14 @@ concurrency:
   group: rocshmem-hygon-github-nmz1-nmz2
   # A new PR commit supersedes the old validation run. Scheduled/manual full
   # runs remain serialized and are never cancelled by another invocation.
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}
 
 jobs:
   build-and-test:
     name: Test (${{ github.event_name == 'schedule' && 'full' || 'standard' }})
+    if: >-
+      github.event_name != 'pull_request_target' ||
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
     runs-on: [self-hosted, Linux, X64, ci, nmz1, bw1100]
     timeout-minutes: 360
     env:
@@ -54,6 +57,7 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v4
         with:
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.ref }}
           persist-credentials: false
           submodules: recursive
 

From 3c668f0e7165d9b3b875d610f88bbcfbd059c165 Mon Sep 17 00:00:00 2001
From: Leewzh <116988731+Leewzh@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:18:38 +0800
Subject: [PATCH 2/2] ci: wrap checkout ref expression

---
 .github/workflows/rocshmem-ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/rocshmem-ci.yml b/.github/workflows/rocshmem-ci.yml
index e1f8996..0b4074b 100644
--- a/.github/workflows/rocshmem-ci.yml
+++ b/.github/workflows/rocshmem-ci.yml
@@ -57,7 +57,10 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.ref }}
+          ref: >-
+            ${{ github.event_name == 'pull_request_target' &&
+                format('refs/pull/{0}/merge', github.event.pull_request.number) ||
+                github.ref }}
           persist-credentials: false
           submodules: recursive