From 1ff39f13f5339a1bf87101f80848bc7b69c089b4 Mon Sep 17 00:00:00 2001
From: Marc Abramowitz <abramowi@adobe.com>
Date: Fri, 20 Jun 2025 11:44:45 -0700
Subject: [PATCH] Replace pull_request with pull_request_target

---
 .github/workflows/e2e_tests.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e_tests.yml
index f620c318..c601e45b 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e_tests.yml
@@ -3,7 +3,7 @@ name: Playwright Tests
 on:
   push:
     branches: [main]
-  pull_request:
+  pull_request_target:
     branches: [main]
 
 permissions:
@@ -20,7 +20,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libwoff1
 
+      # Security: Explicitly checkout the PR's code, not the target branch
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - uses: actions/setup-node@v4
         with: