Update GCP User IAM workflow to use pull_request_target and adjust permissions for better security; change role for a user to beam_viewer for testing

Author: ksobrenat32

.github/workflows/beam_Infrastructure_UsersPermissions.yml

@@ -30,7 +30,8 @@ on:
       - main
     paths:
       - 'infra/iam/users.yml'
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
     paths:
       - 'infra/iam/users.yml'
 
@@ -41,7 +42,7 @@ concurrency:
 
 #Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 jobs:
@@ -51,6 +52,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@v3
       - name: Install Terraform
@@ -85,6 +88,6 @@ jobs:
         run: gh pr comment ${{ github.event.pull_request.number }} --body-file comment_body.txt
 
       - name: Terraform Apply
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'apache/beam'
         working-directory: ./infra/iam
         run: terraform apply -auto-approve tfplan

infra/iam/users.yml

@@ -367,7 +367,7 @@
 - username: enriquecaol04
   email: enriquecaol04@gmail.com
   permissions:
-  - role: roles/viewer
+  - role: projects/apache-beam-testing/roles/beam_viewer
 - username: eventarc-workflow-sa
   email: eventarc-workflow-sa@apache-beam-testing.iam.gserviceaccount.com
   permissions: