ci: allow ci action run on release branches (#31)

## Description

<!-- Provide a brief description of your changes -->

**Note:** PR titles should follow [Conventional
Commits](https://www.conventionalcommits.org/) format (e.g.,
`feat(devbox): add support for custom env vars` or `fix(snapshot):
resolve pagination issue`) as they are used for automatic release notes
generation.

## Type of Change

<!-- Mark the relevant option with an 'x' -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Documentation update
- [ ] Code refactoring
- [ ] Performance improvement
- [ ] Test updates

## Related Issues

<!-- Link to related issues using #issue-number -->
Closes #

## Changes Made

<!-- Describe the changes in detail -->

## Testing

<!-- Describe how you tested your changes -->

- [ ] I have tested locally
- [ ] I have added/updated tests
- [ ] All existing tests pass

## Checklist

- [ ] My code follows the code style of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have updated the documentation accordingly
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published

## Screenshots (if applicable)

<!-- Add screenshots to help explain your changes -->

## Additional Notes

<!-- Any additional information that reviewers should know -->

Author: dines-rl

.github/workflows/ci.yml

@@ -2,14 +2,24 @@ name: CI
 
 on:
   pull_request:
+  pull_request_target:
+    # Run on release-please PRs (created by GITHUB_TOKEN which doesn't trigger regular pull_request)
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
 
 jobs:
   format:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -25,9 +35,16 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -43,9 +60,16 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -62,9 +86,16 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: build
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          # For pull_request_target, explicitly checkout the PR head
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Only checkout PR code if it's from the same repo (safe for release-please)
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -89,7 +120,8 @@ jobs:
   ready-to-merge:
     runs-on: ubuntu-latest
     needs: [format, lint, build, test]
-    if: always()
+    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
+    if: always() && (github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch')
     steps:
       - name: Check all jobs passed
         run: |