Only accept pr target with safe-to-test

And exclude the pr evertn when safe-to-test is set

Author: josvazg

.github/workflows/test.yml

@@ -14,6 +14,9 @@ on:
       - '**'
     paths-ignore:
       - 'docs/**'
+  pull_request_target:
+    types: [labeled]
+    branches: [main]
   merge_group:
   workflow_dispatch:
 
@@ -26,11 +29,14 @@ jobs:
     name: Run Tests
     runs-on: ubuntu-latest
     # Contributions do NOT run any testing by default, a label is needed to allow testing
+    # Only accept either code owner's PRs from the same repo 
+    # or pull_request_target events with the safe-to-test allow flag
     if: |
-      github.event.pull_request.base.repo.full_name == github.event.pull_request.head.repo.full_name ||
-      contains(github.event.pull_request.labels.*.name, 'safe-to-test') ||
-      contains(github.event.pull_request.labels.*.name, 'cloud-tests') ||
-      contains(github.event.pull_request.labels.*.name, 'retest')
+      (github.event.pull_request.base.repo.full_name == github.event.pull_request.head.repo.full_name &&
+      !contains(github.event.pull_request.labels.*.name, 'safe-to-test' &&
+      github.event_name == 'pull_request') || 
+      (contains(github.event.pull_request_target.labels.*.name, 'safe-to-test' &&
+      github.event_name == 'pull_request_target')
     steps:
       - name: allowed message
         run: echo "Allowed to run tests"