CI: run on non-fork PRs at least

.github/workflows/link-checker-pr.yml

@@ -1,16 +1,10 @@
 name: Link Checker (PR Build)
 
-# Disabled. GitHub doesn't actually stop these jobs from running automatically
-# even when they come from untrusted contributors, so this is insecure.
-# on:
-#   # Note: this job runs with in-repo permissions so it can comment and commit
-#   # on stuff in the repo even when the PR is coming from a PR. This means that
-#   # it can, potentially, wreak havoc on the repository by running arbitrary
-#   # code. Be sure to ONLY approve job runs AFTER you have confirmed that the
-#   # commits in question do not contain malicious or suspicious code (especially
-#   # to the .sh or .py files in the tool/ directory.)
-#   pull_request_target:
-#     types: [opened, edited, synchronize]
+on:
+  # Note: DO NOT change this to "pull request_target" since that grants
+  # permission for PRs from random forks to modify the repo itself!
+  pull_request:
+    types: [opened, edited, synchronize]
 
 jobs:
   build:
@@ -19,19 +13,15 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-      with:
-        ref: ${{github.event.pull_request.head.ref}}
-        repository: ${{github.event.pull_request.head.repo.full_name}}
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v2
       with:
-        python-version: "3.7"
+        python-version: "3.9"
 
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install Jinja2==2.11.3
         pip install dactyl lxml
 
     - name: Check for Conflict Markers
@@ -60,8 +50,10 @@ jobs:
       continue-on-error: true
       run: dactyl_style_checker -q > out/style_report.txt
 
-    # new deploy system. TODO: delete folders from gh-pages when PRs are closed
+    # This only works with PRs that are in-repo, not from forks.
+    # TODO: delete folders from gh-pages when PRs are closed
     - name: Deploy to gh-pages
+      if: ${{ !github.event.pull_request.head.repo.fork }}
       uses: peaceiris/actions-gh-pages@v3
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -69,6 +61,7 @@ jobs:
         destination_dir: ./pr-preview/${{ github.head_ref }}
 
     - name: Summarize Output
+      if: ${{ !github.event.pull_request.head.repo.fork }}
       uses: thollander/actions-comment-pull-request@v1
       with:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}