From 4262e1dee5e26b3c2385cb6c67af71c4b3aef265 Mon Sep 17 00:00:00 2001
From: Jordan Dominion <Cyberboss@users.noreply.github.com>
Date: Sat, 17 Aug 2024 11:57:39 -0400
Subject: [PATCH] Maybe GitHub doesn't allow specifying a ref on reusable
 workflows

---
 .github/workflows/ci-security.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-security.yml b/.github/workflows/ci-security.yml
index 14b60544ba..c67a4ca921 100644
--- a/.github/workflows/ci-security.yml
+++ b/.github/workflows/ci-security.yml
@@ -1,6 +1,10 @@
 name: 'CI Security'
 
 on:
+  pull_request:
+    branches:
+    - dev
+    - master
   pull_request_target:
     types: [ opened, reopened, labeled, synchronize ]
     branches:
@@ -14,10 +18,10 @@ concurrency:
 jobs:
   security-checkpoint:
     name: Check CI Clearance
+    if: github.event_name == 'pull_request_target' && (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id || github.event.pull_request.user.id == 49699333) && github.event.pull_request.state == 'open'
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
-    if: (github.event.pull_request.head.repo.id != github.event.pull_request.base.repo.id || github.event.pull_request.user.id == 49699333) && github.event.pull_request.state == 'open'
     steps:
     - name: Comment on new Fork PR
       if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id != 49699333
@@ -55,7 +59,9 @@ jobs:
       run: exit 1
 
   ci-pipline-workflow-call:
-    uses: ./.github/workflows/ci-pipeline.yml@${{ github.event.pull_request.head.sha }}
+    needs: security-checkpoint
+    if: github.event_name != 'pull_request_target' || needs.security-checkpoint.result == 'success'
+    uses: ./.github/workflows/ci-pipeline.yml
     secrets: inherit
     with:
       pull_request_number: ${{ github.event.pull_request.number }}