checkout new pr

Author: jiridanek

.github/workflows/build-notebooks-TEMPLATE.yaml

@@ -48,6 +48,14 @@ jobs:
     steps:
 
       - uses: actions/checkout@v4
+        if: ${{ !fromJson(inputs.github).event_name == 'pull_request_target' }}
+
+      # we need to checkout the pr branch, not pr target (the default)
+      # user access check is done in calling workflow
+      - uses: actions/checkout@v4
+        if: ${{ fromJson(inputs.github).event_name == 'pull_request_target' }}
+        with:
+          ref: "refs/pull/${{ fromJson(inputs.github).event.number }}/merge"
 
       - run: mkdir -p $TMPDIR