[gha] allow external contributors build/lint

Author: rustielin

.github/workflows/ci.yml

@@ -4,11 +4,23 @@ on:
   push:
     branches:
       - main
-  pull_request:
+  pull_request_target:
+    branches:
+      - rustielin/ci-for-ai-chatbot # canary for the PR that introduces pull_request_target
 
 jobs:
+  permission-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check repository permission for user which triggered workflow
+        uses: sushichop/action-repository-permission@13d208f5ae7a6a3fc0e5a7c2502c214983f0241c
+        with:
+          required-permission: write
+          comment-not-permitted: Sorry, you don't have permission to trigger this workflow.
+
   lint:
     runs-on: ubuntu-latest
+    needs: permission-check # This is required to ensure we have permission to build against the GCP Artifact Registry
 
     steps:
       - uses: actions/checkout@v4