dont use pull_request_target as it opens the repo for pwnage..

.github/workflows/tests.yml

@@ -1,5 +1,5 @@
 on:
-  pull_request_target: # Use pull_request_target
+  pull_request:
     branches: [master, beta, release]
 
 jobs:
@@ -12,8 +12,6 @@ jobs:
       options: --user root
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: '${{ github.event.pull_request.merge_commit_sha }}' # since event is pull_request_target
       - name: Install Packages
         run: yarn install --frozen-lockfile
       - name: Build