Support 'pull_request' event type

[hainest]

I found that I was getting a pull_request[1] event, but not a pull_request_target[2] when creating a pull request on a test repo. The docs for each say that they are both fired when a PR is opened, so I'm not sure why I wasn't seeing both.

Even though the 'pull_request' event uses the merge commit of the PR, github.event.pull_request.head.sha still refers to the last commit in the head branch of the PR.

There is a lot of discussion about the security[3] of pull_request_target. In particular, the workflow uses the GITHUB_TOKEN from the base repository which may be overly permissive. This update does not attempt to address those concerns.

[1] https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
[2] https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target
[3] https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target

[vicentebolea]

pull_request_target is needed since we want to have a GITHUB_TOKEN with perms to write commit status. pull_request types of event does not provides it.

The reason why pull_request_target does not trigger this in your PR is that pull_request_target will load the current version of master(main branch) CI files, no the PR version. This is why allows to have a permissive GITHUB_TOKEN since it naturally hedge against PR attacks.

[hainest]

Per-job permissions are preferred for using the action. See tools-integration/tools-sdk#17.