diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6f086ef91..a314418e2f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,18 +2,89 @@ name: 'Build & Test (Linux)'
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [ "fix_ci_dev" ]
   pull_request:
-    branches: [ "main" ]
+    branches: [ "fix_ci_dev" ]
     types: [opened, synchronize, reopened, labeled]
-
+  pull_request_target:
+    branches: [ "fix_ci_dev" ]
+    types: [labeled, synchronize]
 
 jobs:
+  security-gate:
+    runs-on: ubuntu-22.04
+    outputs:
+      run_basic_jobs: ${{ steps.check.outputs.run_basic }}
+      run_integration_test: ${{ steps.check.outputs.run_integration }}
+      is_fork_pr: ${{steps.check.outputs.is_fork}}
+    steps:
+      - id: check
+        run: |
+          echo "Event: ${{ github.event_name }}"
+          echo "Action: ${{ github.event.action }}"
+
+          IS_FORK="false"
+          if [[ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+            IS_FORK="true"
+          fi
+          echo "is_fork=${IS_FORK}" >> $GITHUB_OUTPUT
+          echo "Is Fork PR: ${IS_FORK}"
+          
+          echo "Checking if we should run basic or integration tests..."
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            echo "run_basic=true" >> $GITHUB_OUTPUT
+            echo "run_integration=true" >> $GITHUB_OUTPUT
+            echo "✅ Push - run all jobs"
+            exit 0
+          fi
+          
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            SHOULD_RUN="false"
+            if [[ "${{ github.event.action }}" == "opened" ]] || \
+               [[ "${{ contains(github.event.pull_request.labels.*.name, 'run-ci') }}" == "true" ]] || \
+               [[ "${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}" == "true" ]]; then
+              SHOULD_RUN="true"
+            fi
+            
+            if [[ "${SHOULD_RUN}" == "true" ]]; then
+              echo "run_basic=true" >> $GITHUB_OUTPUT
+              
+              if [[ "${IS_FORK}" == "false" ]]; then
+                echo "run_integration=true" >> $GITHUB_OUTPUT
+                echo "✅ Internal PR - run all jobs (including integration test)"
+              else
+                echo "run_integration=false" >> $GITHUB_OUTPUT
+                echo "✅ Fork PR - run basic jobs only (integration test needs approval)"
+              fi
+            else
+              echo "run_basic=false" >> $GITHUB_OUTPUT
+              echo "run_integration=false" >> $GITHUB_OUTPUT
+              echo "⏭️ PR without label - skip all jobs"
+            fi
+            exit 0
+          fi
+          
+          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
+            if [[ "${{ contains(github.event.pull_request.labels.*.name, 'run-ci') }}" == "true" ]] || \
+               [[ "${{ contains(github.event.pull_request.labels.*.name, 'approved-for-ci') }}" == "true" ]]; then
+              echo "run_basic=false" >> $GITHUB_OUTPUT          
+              echo "run_integration=true" >> $GITHUB_OUTPUT     
+              echo "✅ pull_request_target with label - run integration test only"
+            else
+              echo "run_basic=false" >> $GITHUB_OUTPUT
+              echo "run_integration=false" >> $GITHUB_OUTPUT
+              echo "⏭️ pull_request_target without label - skip"
+            fi
+            exit 0
+          fi
+          
+          echo "run_basic=false" >> $GITHUB_OUTPUT
+          echo "run_integration=false" >> $GITHUB_OUTPUT
+        shell: bash
+
   build:
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     strategy:
       matrix:
@@ -186,10 +257,8 @@ jobs:
       shell: bash
 
   build-musa:
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     container: mthreads/musa:rc4.3.0-devel-ubuntu22.04-amd64
     steps:
@@ -217,7 +286,8 @@ jobs:
       shell: bash
 
   test-wheel-ubuntu:
-    needs: build-flags
+    needs: [security-gate, build-flags]
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     strategy:
       matrix:
         ubuntu-version: [ubuntu-22.04, ubuntu-24.04]
@@ -340,84 +410,9 @@ jobs:
         # python -m unittest mooncake-wheel.tests.test_mooncake_backend_p2p_cpu
       shell: bash
 
-  test-sglang-integration:
-    needs: build-flags
-    runs-on: ubuntu-latest
-    env:
-      tone_user_name: ${{ secrets.TONE_USER_NAME }}
-    steps:
-      - name: trigger T-one test
-        if: ${{ env.tone_user_name != '' }}
-        run: |
-          max_attempts=5
-          attempt=1
-          while [ $attempt -le $max_attempts ]; do
-            echo "Attempt $attempt: Fetching artifact..."
-            if curl -L -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts > artifact.json; then
-              echo "Successfully fetched artifact"
-              break
-            else
-              echo "Failed to fetch artifact. Retrying..."
-              sleep 60
-            fi
-            attempt=$((attempt + 1))
-          done
-          if [ $attempt -gt $max_attempts ]; then
-            echo "Failed to fetch artifacts after $max_attempts attempts"
-            exit 1
-          fi
-
-          cat artifact.json
-          artifact_id=$(jq -r ".artifacts[] | select(.name | contains(\"py312\") ) | .id" artifact.json)
-          signature="${{ secrets.TONE_USER_NAME }}|${{ secrets.TONE_USER_TOKEN }}|$(python3 -c "import time;print(time.time())")"
-          signature="$(python3 -c "import base64;print(base64.b64encode(\"$signature\".encode('utf-8')).decode('utf-8'))")"
-          curl -s -H 'Content-Type: application/json' -X POST -d "{\"workspace\":\"mooncake_test\",\"project\":\"mooncake-ci\",\"template\":\"mooncake-ci-test\",\"name\":\"mooncake-ci-${{ github.sha }}\",\"username\":\"${{ secrets.TONE_USER_NAME }}\",\"env_ifs\":\" \",\"env_info\":\"ARTIFACT_ID=${artifact_id} GIT_REPO=${{ github.repository }}\",\"signature\":\"$signature\"}" https://tone.openanolis.cn/api/job/create/ > job.json
-          if [ "$(jq .code job.json)" == 200 ]; then
-            echo "job created"
-          else
-            echo "job create failed"
-            exit 1
-          fi
-          job_id=$(jq .data.id job.json)
-          echo "check job status here and remember to cancel it before restart the job !"
-          echo "job_url: https://tone.openanolis.cn/ws/gclfnh19/test_result/${job_id}?tab=4"
-          echo "job_id=${job_id}" >> $GITHUB_ENV
-        shell: bash
-
-      - name: qurey job results
-        if: ${{ env.tone_user_name != '' }}
-        run: |
-          time=0
-          while true; do
-            if [ $time -gt 720 ]; then
-              echo "timeout"
-              exit 1
-            fi
-            signature="${{ secrets.TONE_USER_NAME }}|${{ secrets.TONE_USER_TOKEN }}|$(python3 -c "import time;print(time.time())")"
-            signature="$(python3 -c "import base64;print(base64.b64encode(\"$signature\".encode('utf-8')).decode('utf-8'))")"
-            curl -s -H 'Content-Type: application/json' -X POST -d "{\"username\":\"${{ secrets.TONE_USER_NAME }}\", \"signature\":\"$signature\", \"job_id\": \"${job_id}\"}" https://tone.openanolis.cn/api/job/query/ > job_status.json
-            if ! [ "$(jq .code job_status.json)" == 200 ]; then
-              echo "job query failed"
-              exit 1
-            fi
-            job_status=$(jq .data.job_second_state job_status.json)
-            if [[ $job_status =~ "pass" ]]; then
-              echo "job successful !"
-              exit 0
-            elif [[ $job_status =~ "fail" ]] ; then
-              echo "job failed or stopped !"
-              exit 1
-            fi
-            time=$(( time + 1))
-            sleep 10
-          done
-        shell: bash
-
   build-flags:
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     strategy:
       matrix:
@@ -565,12 +560,100 @@ jobs:
         name: mooncake-wheel-ubuntu-py${{ steps.generate_tag_flags.outputs.python_version_tag }}
         path: mooncake-wheel/dist-py${{ steps.generate_tag_flags.outputs.python_version_tag }}/*.whl
 
+  test-sglang-integration:
+    needs: security-gate
+    if: needs.security-gate.outputs.run_integration_test == 'true'
+    runs-on: ubuntu-latest
+    env:
+      tone_user_name: ${{ secrets.TONE_USER_NAME }}
+    steps: 
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      
+      - name: Log execution context
+        run: |
+          echo "Event: ${{ github.event_name }}"
+          echo "Is Fork PR: ${{ needs.security-gate.outputs.is_fork_pr }}"
+          echo "PR Number: ${{ github.event.pull_request.number }}"
+          if [[ "${{ github.event.pull_request.head.repo.full_name }}" != "" ]]; then
+            echo "PR From: ${{ github.event.pull_request.head.repo.full_name }}"
+          fi
+        shell: bash
+      
+      - name: trigger T-one test
+        if: ${{ env.tone_user_name != '' }}
+        run: |
+          max_attempts=10
+          attempt=1
+          while [ $attempt -le $max_attempts ]; do
+            echo "Attempt $attempt: Fetching artifact..."
+            if curl -L -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts > artifact.json; then
+              echo "Successfully fetched artifact"
+              break
+            else
+              echo "Failed to fetch artifact. Retrying..."
+              if [ $attempt -lt $max_attempts ]; then
+                sleep $((attempt * 60))
+              fi
+            fi
+            attempt=$((attempt + 1))
+          done
+          if [ $attempt -gt $max_attempts ]; then
+            echo "Failed to fetch artifacts after $max_attempts attempts"
+            exit 1
+          fi
+
+          cat artifact.json
+          artifact_id=$(jq -r ".artifacts[] | select(.name | contains(\"py312\") ) | .id" artifact.json)
+          signature="${{ secrets.TONE_USER_NAME }}|${{ secrets.TONE_USER_TOKEN }}|$(python3 -c "import time;print(time.time())")"
+          signature="$(python3 -c "import base64;print(base64.b64encode(\"$signature\".encode('utf-8')).decode('utf-8'))")"
+          curl -s -H 'Content-Type: application/json' -X POST -d "{\"workspace\":\"mooncake_test\",\"project\":\"mooncake-ci\",\"template\":\"mooncake-ci-test\",\"name\":\"mooncake-ci-${{ github.sha }}\",\"username\":\"${{ secrets.TONE_USER_NAME }}\",\"env_ifs\":\" \",\"env_info\":\"ARTIFACT_ID=${artifact_id} GIT_REPO=${{ github.repository }}\",\"signature\":\"$signature\"}" https://tone.openanolis.cn/api/job/create/ > job.json
+          if [ "$(jq .code job.json)" == 200 ]; then
+            echo "job created"
+          else
+            echo "job create failed"
+            exit 1
+          fi
+          job_id=$(jq .data.id job.json)
+          echo "check job status here and remember to cancel it before restart the job !"
+          echo "job_url: https://tone.openanolis.cn/ws/gclfnh19/test_result/${job_id}?tab=4"
+          echo "job_id=${job_id}" >> $GITHUB_ENV
+        shell: bash
+
+      - name: qurey job results
+        if: ${{ env.tone_user_name != '' }}
+        run: |
+          time=0
+          while true; do
+            if [ $time -gt 720 ]; then
+              echo "timeout"
+              exit 1
+            fi
+            signature="${{ secrets.TONE_USER_NAME }}|${{ secrets.TONE_USER_TOKEN }}|$(python3 -c "import time;print(time.time())")"
+            signature="$(python3 -c "import base64;print(base64.b64encode(\"$signature\".encode('utf-8')).decode('utf-8'))")"
+            curl -s -H 'Content-Type: application/json' -X POST -d "{\"username\":\"${{ secrets.TONE_USER_NAME }}\", \"signature\":\"$signature\", \"job_id\": \"${job_id}\"}" https://tone.openanolis.cn/api/job/query/ > job_status.json
+            if ! [ "$(jq .code job_status.json)" == 200 ]; then
+              echo "job query failed"
+              exit 1
+            fi
+            job_status=$(jq .data.job_second_state job_status.json)
+            if [[ $job_status =~ "pass" ]]; then
+              echo "job successful !"
+              exit 0
+            elif [[ $job_status =~ "fail" ]] ; then
+              echo "job failed or stopped !"
+              exit 1
+            fi
+            time=$(( time + 1))
+            sleep 10
+          done
+        shell: bash
+
   build-docker:
     name: Build Docker Image
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v4
@@ -583,10 +666,8 @@ jobs:
 
   spell-check:
     name: Spell Check with Typos
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout Actions Repository
@@ -596,10 +677,8 @@ jobs:
 
   clang-format:
     name: Check code format
-    if: >-
-      github.event_name == 'push' ||
-      github.event.action == 'opened' ||
-      contains(github.event.pull_request.labels.*.name, 'run-ci')
+    needs: security-gate
+    if: needs.security-gate.outputs.run_basic_jobs == 'true'
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout Actions Repository