From 79a102b98c2d3a53d4ce7d07fd3c0bfe5aca44fe Mon Sep 17 00:00:00 2001
From: Matt White <16320656+matt-FFFFFF@users.noreply.github.com>
Date: Mon, 20 Jan 2025 10:31:30 +0000
Subject: [PATCH] ci: remove PR target

---
 .github/workflows/go-test-deployment.yml | 23 ++++++++++++++---------
 .github/workflows/go-test-unit.yml       | 21 +++++++--------------
 2 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/go-test-deployment.yml b/.github/workflows/go-test-deployment.yml
index ee796b22..221810f3 100644
--- a/.github/workflows/go-test-deployment.yml
+++ b/.github/workflows/go-test-deployment.yml
@@ -2,7 +2,7 @@
 name: Deployment test
 
 on:
-  pull_request_target:
+  pull_request:
     types: ['opened', 'reopened', 'synchronize', 'labeled']
   workflow_dispatch:
     inputs:
@@ -36,7 +36,13 @@ jobs:
     if: |
       (
         (
-          contains(github.event.pull_request.labels.*.name, 'PR: Safe to test :test_tube:')
+          (
+            contains(github.event.pull_request.labels.*.name, 'PR: Safe to test :test_tube:')
+          )
+          &&
+          (
+            github.event.pull_request.head.repo.full_name == 'Azure/terraform-azurerm-lz-vending'
+          )
         )
         ||
         (
@@ -55,25 +61,24 @@ jobs:
         run: env | sort
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
           terraform_version: ${{ matrix.terraform_version }}
           terraform_wrapper: false
 
       - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: '1.20.x'
+          go-version-file: tests/go.mod
           cache-dependency-path: tests/go.sum
 
       - name: Azure login
-        uses: azure/login@v2
+        uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -108,7 +113,7 @@ jobs:
 
       # This only works on Linux based runners
       - name: Azure logout
-        uses: azure/CLI@v2
+        uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
         if: always()
         with:
           inlineScript: |
diff --git a/.github/workflows/go-test-unit.yml b/.github/workflows/go-test-unit.yml
index b735ae6a..9cc13ff2 100644
--- a/.github/workflows/go-test-unit.yml
+++ b/.github/workflows/go-test-unit.yml
@@ -2,7 +2,7 @@
 name: Unit test
 
 on:
-  pull_request_target:
+  pull_request:
     types: ['opened', 'reopened', 'synchronize', 'labeled']
   merge_group:
   workflow_dispatch:
@@ -40,12 +40,6 @@ jobs:
         github.event.pull_request.head.repo.full_name == 'Azure/terraform-azurerm-lz-vending'
       )
       ||
-      (
-        github.event.pull_request.head.repo.full_name != 'Azure/terraform-azurerm-lz-vending'
-        &&
-        contains(github.event.pull_request.labels.*.name, 'PR: Safe to test :test_tube:')
-      )
-      ||
       (
         github.event_name == 'workflow_dispatch'
       )
@@ -56,24 +50,23 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        azapi_version: ['latest', '1.11.0']
-        azurerm_version: ['latest', '3.7.0']
-        terraform_version: ['latest', '1.4.0']
+        azapi_version: ['latest', '2.2.0']
+        azurerm_version: ['latest', '4.0.0']
+        terraform_version: ['latest', '1.8.0']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
           terraform_version: ${{ matrix.terraform_version }}
           terraform_wrapper: false
 
       - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
           go-version-file: tests/go.mod
           cache-dependency-path: tests/go.sum